labstack echo
18 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-118658 | >= 5.0.0, < 5.1.1 ; < 4.15.2 | Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-118657 | >= 5.0.0, < 5.4.0 ; < 4.16.0 | Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers | MEDIUM 5.9 | 0.1 % | ||
| CVE-2026-118656 | >= 5.0.0, < 5.4.0 ; < 4.16.0 | Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-118655 | >= 5.0.0, < 5.2.0 ; < 4.15.3 | Echo: Static Middleware Double-Unescape Path Traversal | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-118654 | < 4.16.0 ; >= 5.0.0, < 5.4.0 | Echo static file middleware route protection bypass via encoded dot-dot traversal | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-118653 | >= 4.0.0, < 5.1.0 | Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-118652 | < 4.16.0 ; >= 5.0.0, < 5.4.0 | Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-118651 | >= 4.0.0, < 5.4.0 | Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-118650 | >= 5.0.0, < 5.4.0 ; < 4.16.0 | Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path | HIGH 7.5 | 0.4 % | ||
| CVE-2026-118266 | < 4.16.0 ; >= 5.0.0, < 5.4.0 | Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-118265 | >= 5.0.0, < 5.4.1 | Echo: X-Real-IP extractor trusts the header value instead of the sending peer | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-118264 | >= 4.0.0, < 4.16.1 ; >= 5.0.0, < 5.4.1 | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-118263 | >= 5.0.0, < 5.4.1 | Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-118262 | >= 4.15.0, < 4.16.1 ; >= 5.0.0, < 5.4.1 | Echo: WebSocket proxy can retain connections and handlers after client disconnect | HIGH 8.2 | 0.3 % | ||
| CVE-2026-118261 | >= 4.0.0, < 4.16.1 | Echo: Decompress permits unbounded gzip expansion in v4 | HIGH 8.2 | 0.4 % | ||
| CVE-2026-118260 | >= 4.0.0, < 4.16.1 | Echo: BodyDump captures request and response bodies without size limits in v4 | HIGH 8.2 | 0.4 % | ||
| CVE-2026-55677 | < 4.15.3 ; >= 5.0.0, < 5.2.0 | Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files | HIGH 7.5 | 0.5 % | ||
| CVE-2026-25766 | >= 5.0.0, < 5.0.3 | Echo has a Windows path traversal via backslash in middleware.Static default filesystem | MEDIUM 5.3 | 0.4 % |