github.com/labstack/echo/v5
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- Go
- Vulnerability status
- 15 advisory(ies) without a verdict
Advisories (15)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-23wf-92cp-8pcj Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto | < 5.1.1 | Undetermined |
| GHSA-2ffq-g2xg-c22p Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers | < 5.4.0 | Undetermined |
| GHSA-375p-5qhx-8wq4 Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path | < 5.4.0 | Undetermined |
| GHSA-3pmx-cf9f-34xr Echo static file middleware route protection bypass via encoded dot-dot traversal | < 5.4.0 | Undetermined |
| GHSA-9969-6676-49h5 Echo: WebSocket proxy can retain connections and handlers after client disconnect | 5.0.0 – < 5.4.1 | Undetermined |
| GHSA-cxf3-9h37-7rr8 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls | 5.0.0 – < 5.4.1 | Undetermined |
| GHSA-h53f-rm2w-w7rg Echo: X-Real-IP extractor trusts the header value instead of the sending peer | 5.0.0 – < 5.4.1 | Undetermined |
| GHSA-h9g5-28mm-hx3g Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob | < 5.4.0 | Undetermined |
| GHSA-pgvm-wxw2-hrv9 Echo has a Windows path traversal via backslash in middleware.Static default filesystem | 5.0.0 – < 5.0.3 | Undetermined |
| GHSA-v753-g4cw-jm48 Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI | < 5.4.0 | Undetermined |
| GHSA-vfp3-v2gw-7wfq Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files | < 5.2.0 | Undetermined |
| GHSA-x9ff-22gv-65f4 Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests | 5.0.0 – < 5.4.1 | Undetermined |
| GHSA-xwq5-6cqp-vx96 Echo has a Static Middleware Double-Unescape Path Traversal | < 5.2.0 | Undetermined |
| GO-2026-4502 Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5 | 5.0.0 – < 5.0.3 | Undetermined |
| GO-2026-6293 Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5 | < 5.2.0 | Undetermined |
Sources
| Source | Licence |
|---|