Refine your search
18 vulnerabilities found for echo by labstack
CVE-2026-118658 (GCVE-0-2026-118658)
Vulnerability from cvelistv5
Published
2026-10-28 20:17
Modified
2026-10-28 20:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Summary
Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.1.1"
},
{
"status": "affected",
"version": "\u003c 4.15.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T20:17:11.083Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj"
},
{
"name": "https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181"
},
{
"name": "https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v4.15.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v4.15.2"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.1.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.1.1"
}
],
"source": {
"advisory": "GHSA-23wf-92cp-8pcj",
"discovery": "UNKNOWN"
},
"title": "Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118658",
"datePublished": "2026-10-28T20:17:11.083Z",
"dateReserved": "2026-10-28T17:25:37.561Z",
"dateUpdated": "2026-10-28T20:17:11.083Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118657 (GCVE-0-2026-118657)
Vulnerability from cvelistv5
Published
2026-10-28 20:14
Modified
2026-10-28 20:14
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-346 - Origin Validation Error
Summary
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.4.0"
},
{
"status": "affected",
"version": "\u003c 4.16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T20:14:09.883Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p"
},
{
"name": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"
},
{
"name": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v4.16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v4.16.0"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.4.0"
}
],
"source": {
"advisory": "GHSA-2ffq-g2xg-c22p",
"discovery": "UNKNOWN"
},
"title": "Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118657",
"datePublished": "2026-10-28T20:14:09.883Z",
"dateReserved": "2026-10-28T17:25:37.561Z",
"dateUpdated": "2026-10-28T20:14:09.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118656 (GCVE-0-2026-118656)
Vulnerability from cvelistv5
Published
2026-10-28 20:12
Modified
2026-10-28 20:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Summary
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.4.0"
},
{
"status": "affected",
"version": "\u003c 4.16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T20:12:13.757Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48"
},
{
"name": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"
},
{
"name": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v4.16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v4.16.0"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.4.0"
}
],
"source": {
"advisory": "GHSA-v753-g4cw-jm48",
"discovery": "UNKNOWN"
},
"title": "Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118656",
"datePublished": "2026-10-28T20:12:13.757Z",
"dateReserved": "2026-10-28T17:25:37.561Z",
"dateUpdated": "2026-10-28T20:12:13.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118655 (GCVE-0-2026-118655)
Vulnerability from cvelistv5
Published
2026-10-28 20:03
Modified
2026-10-28 20:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-174 - Double Decoding of the Same Data
Summary
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.2.0"
},
{
"status": "affected",
"version": "\u003c 4.15.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-174",
"description": "CWE-174: Double Decoding of the Same Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T20:03:56.897Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96"
},
{
"name": "https://github.com/labstack/echo/issues/2599",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/issues/2599"
},
{
"name": "https://github.com/labstack/echo/pull/3006",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/pull/3006"
},
{
"name": "https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6"
},
{
"name": "https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v4.15.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v4.15.3"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.2.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.2.0"
}
],
"source": {
"advisory": "GHSA-xwq5-6cqp-vx96",
"discovery": "UNKNOWN"
},
"title": "Echo: Static Middleware Double-Unescape Path Traversal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118655",
"datePublished": "2026-10-28T20:03:56.897Z",
"dateReserved": "2026-10-28T17:25:37.561Z",
"dateUpdated": "2026-10-28T20:03:56.897Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118654 (GCVE-0-2026-118654)
Vulnerability from cvelistv5
Published
2026-10-28 19:59
Modified
2026-10-28 19:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read files that an application intended to protect with route-level middleware, when those files are also reachable through a static filesystem mount after path normalization. This vulnerability is the result of an incomplete fix for CVE-2026-55677. This issue is fixed in 4.16.0 and 5.4.0.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003c 4.16.0"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo\u0027s static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read files that an application intended to protect with route-level middleware, when those files are also reachable through a static filesystem mount after path normalization. This vulnerability is the result of an incomplete fix for CVE-2026-55677. This issue is fixed in 4.16.0 and 5.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:59:27.911Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr"
},
{
"name": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"
},
{
"name": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v4.16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v4.16.0"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.4.0"
}
],
"source": {
"advisory": "GHSA-3pmx-cf9f-34xr",
"discovery": "UNKNOWN"
},
"title": "Echo static file middleware route protection bypass via encoded dot-dot traversal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118654",
"datePublished": "2026-10-28T19:59:27.911Z",
"dateReserved": "2026-10-28T17:25:37.561Z",
"dateUpdated": "2026-10-28T19:59:27.911Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118653 (GCVE-0-2026-118653)
Vulnerability from cvelistv5
Published
2026-10-28 19:42
Modified
2026-10-28 19:42
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-290 - Authentication Bypass by Spoofing
Summary
Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling used for controls such as brute-force or request-volume protection. This issue is fixed in Echo v5.1.0.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 5.1.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling used for controls such as brute-force or request-volume protection. This issue is fixed in Echo v5.1.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290: Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:42:05.556Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq"
},
{
"name": "https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.1.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.1.0"
}
],
"source": {
"advisory": "GHSA-246p-cpwv-v3jq",
"discovery": "UNKNOWN"
},
"title": "Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118653",
"datePublished": "2026-10-28T19:42:05.556Z",
"dateReserved": "2026-10-28T17:25:37.561Z",
"dateUpdated": "2026-10-28T19:42:05.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118652 (GCVE-0-2026-118652)
Vulnerability from cvelistv5
Published
2026-10-28 19:35
Modified
2026-10-28 19:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003c 4.16.0"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:35:47.103Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g"
},
{
"name": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"
},
{
"name": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v4.16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v4.16.0"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.4.0"
}
],
"source": {
"advisory": "GHSA-h9g5-28mm-hx3g",
"discovery": "UNKNOWN"
},
"title": "Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118652",
"datePublished": "2026-10-28T19:35:47.103Z",
"dateReserved": "2026-10-28T17:25:37.561Z",
"dateUpdated": "2026-10-28T19:35:47.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118651 (GCVE-0-2026-118651)
Vulnerability from cvelistv5
Published
2026-10-28 19:30
Modified
2026-10-28 19:31
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-346 - Origin Validation Error
Summary
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 5.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo\u0027s forwarded identity. This issue is fixed in Echo 5.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:31:47.851Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36"
},
{
"name": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.4.0"
}
],
"source": {
"advisory": "GHSA-99jh-6h7p-pp36",
"discovery": "UNKNOWN"
},
"title": "Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118651",
"datePublished": "2026-10-28T19:30:01.320Z",
"dateReserved": "2026-10-28T17:25:37.561Z",
"dateUpdated": "2026-10-28T19:31:47.851Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118650 (GCVE-0-2026-118650)
Vulnerability from cvelistv5
Published
2026-10-28 19:25
Modified
2026-10-28 19:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash resolving to a file under the static root through the global static middleware, but the source is internally inconsistent about whether a route or group guard protects the corresponding literal path in that global-mount configuration. This issue is fixed in 4.16.0 and 5.4.0.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.4.0"
},
{
"status": "affected",
"version": "\u003c 4.16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo\u0027s router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash resolving to a file under the static root through the global static middleware, but the source is internally inconsistent about whether a route or group guard protects the corresponding literal path in that global-mount configuration. This issue is fixed in 4.16.0 and 5.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-177",
"description": "CWE-177: Improper Handling of URL Encoding (Hex Encoding)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:25:02.952Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-375p-5qhx-8wq4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-375p-5qhx-8wq4"
},
{
"name": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"
},
{
"name": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v4.16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v4.16.0"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.4.0"
}
],
"source": {
"advisory": "GHSA-375p-5qhx-8wq4",
"discovery": "UNKNOWN"
},
"title": "Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118650",
"datePublished": "2026-10-28T19:25:02.952Z",
"dateReserved": "2026-10-28T17:25:37.560Z",
"dateUpdated": "2026-10-28T19:25:02.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118266 (GCVE-0-2026-118266)
Vulnerability from cvelistv5
Published
2026-10-28 19:21
Modified
2026-10-28 19:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Summary
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POST handler but the override changes the method before CSRF evaluates it, causing both token validation and Sec-Fetch-Site checks to be skipped. A cross-site exploit requires an authenticated victim and an override value that a browser-submitted request can control, such as the form getter used by the advisory reproducer; the default X-HTTP-Method-Override header getter is not settable by a cross-site form. This issue is fixed in 4.16.0 and 5.4.0.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003c 4.16.0"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo\u0027s MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POST handler but the override changes the method before CSRF evaluates it, causing both token validation and Sec-Fetch-Site checks to be skipped. A cross-site exploit requires an authenticated victim and an override value that a browser-submitted request can control, such as the form getter used by the advisory reproducer; the default X-HTTP-Method-Override header getter is not settable by a cross-site form. This issue is fixed in 4.16.0 and 5.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352: Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:21:47.729Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4"
},
{
"name": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"
},
{
"name": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v4.16.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v4.16.0"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.4.0"
}
],
"source": {
"advisory": "GHSA-r7w9-592q-9vg4",
"discovery": "UNKNOWN"
},
"title": "Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118266",
"datePublished": "2026-10-28T19:21:47.729Z",
"dateReserved": "2026-10-27T20:13:55.314Z",
"dateUpdated": "2026-10-28T19:21:47.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118265 (GCVE-0-2026-118265)
Vulnerability from cvelistv5
Published
2026-10-28 19:03
Modified
2026-10-28 19:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-348 - Use of Less Trusted Source
Summary
Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5\u0027s ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-348",
"description": "CWE-348: Use of Less Trusted Source",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:03:56.934Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg"
},
{
"name": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.4.1"
}
],
"source": {
"advisory": "GHSA-h53f-rm2w-w7rg",
"discovery": "UNKNOWN"
},
"title": "Echo: X-Real-IP extractor trusts the header value instead of the sending peer"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118265",
"datePublished": "2026-10-28T19:03:56.934Z",
"dateReserved": "2026-10-27T20:13:55.314Z",
"dateUpdated": "2026-10-28T19:03:56.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118264 (GCVE-0-2026-118264)
Vulnerability from cvelistv5
Published
2026-10-28 19:03
Modified
2026-10-28 19:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.16.1"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo\u0027s Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo\u0027s router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:03:01.533Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8"
},
{
"name": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"
},
{
"name": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v4.16.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v4.16.1"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.4.1"
}
],
"source": {
"advisory": "GHSA-cxf3-9h37-7rr8",
"discovery": "UNKNOWN"
},
"title": "Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118264",
"datePublished": "2026-10-28T19:03:01.533Z",
"dateReserved": "2026-10-27T20:13:55.314Z",
"dateUpdated": "2026-10-28T19:03:01.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118263 (GCVE-0-2026-118263)
Vulnerability from cvelistv5
Published
2026-10-28 19:01
Modified
2026-10-28 19:01
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-252 - Unchecked Return Value
Summary
Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5\u0027s BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump\u0027s capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252: Unchecked Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:01:30.268Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-x9ff-22gv-65f4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-x9ff-22gv-65f4"
},
{
"name": "https://github.com/labstack/echo/pull/3105",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/pull/3105"
},
{
"name": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.4.1"
}
],
"source": {
"advisory": "GHSA-x9ff-22gv-65f4",
"discovery": "UNKNOWN"
},
"title": "Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118263",
"datePublished": "2026-10-28T19:01:30.268Z",
"dateReserved": "2026-10-27T20:13:55.314Z",
"dateUpdated": "2026-10-28T19:01:30.268Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118262 (GCVE-0-2026-118262)
Vulnerability from cvelistv5
Published
2026-10-28 19:00
Modified
2026-10-28 19:00
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-772 - Missing Release of Resource after Effective Lifetime
Summary
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.15.0, \u003c 4.16.1"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo\u0027s Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-772",
"description": "CWE-772: Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:00:12.315Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5"
},
{
"name": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"
},
{
"name": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v4.16.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v4.16.1"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v5.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v5.4.1"
}
],
"source": {
"advisory": "GHSA-9969-6676-49h5",
"discovery": "UNKNOWN"
},
"title": "Echo: WebSocket proxy can retain connections and handlers after client disconnect"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118262",
"datePublished": "2026-10-28T19:00:12.315Z",
"dateReserved": "2026-10-27T20:13:55.314Z",
"dateUpdated": "2026-10-28T19:00:12.315Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118261 (GCVE-0-2026-118261)
Vulnerability from cvelistv5
Published
2026-10-28 18:58
Modified
2026-10-28 18:58
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.16.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4\u0027s opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T18:58:43.504Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-h7wr-284f-5qvc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-h7wr-284f-5qvc"
},
{
"name": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v4.16.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v4.16.1"
}
],
"source": {
"advisory": "GHSA-h7wr-284f-5qvc",
"discovery": "UNKNOWN"
},
"title": "Echo: Decompress permits unbounded gzip expansion in v4"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118261",
"datePublished": "2026-10-28T18:58:43.504Z",
"dateReserved": "2026-10-27T20:13:55.314Z",
"dateUpdated": "2026-10-28T18:58:43.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118260 (GCVE-0-2026-118260)
Vulnerability from cvelistv5
Published
2026-10-28 18:56
Modified
2026-10-28 18:56
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.16.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4\u0027s opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T18:56:56.747Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv"
},
{
"name": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"
},
{
"name": "https://github.com/labstack/echo/releases/tag/v4.16.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/releases/tag/v4.16.1"
}
],
"source": {
"advisory": "GHSA-f48p-c9v4-h7xv",
"discovery": "UNKNOWN"
},
"title": "Echo: BodyDump captures request and response bodies without size limits in v4"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-118260",
"datePublished": "2026-10-28T18:56:56.747Z",
"dateReserved": "2026-10-27T20:13:55.314Z",
"dateUpdated": "2026-10-28T18:56:56.747Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55677 (GCVE-0-2026-55677)
Vulnerability from cvelistv5
Published
2026-06-26 16:15
Modified
2026-06-26 16:50
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55677",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-26T16:50:52.168170Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T16:50:57.019Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003c 4.15.3"
},
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.2.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo\u0027s router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T16:15:55.633Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"
}
],
"source": {
"advisory": "GHSA-vfp3-v2gw-7wfq",
"discovery": "UNKNOWN"
},
"title": "Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55677",
"datePublished": "2026-06-26T16:15:55.633Z",
"dateReserved": "2026-06-17T00:05:03.778Z",
"dateUpdated": "2026-06-26T16:50:57.019Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25766 (GCVE-0-2026-25766)
Vulnerability from cvelistv5
Published
2026-02-19 15:49
Modified
2026-02-19 19:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In `middleware/static.go`, the requested path is unescaped and normalized with `path.Clean` (URL semantics). `path.Clean` does not treat `\` as a path separator, so `..\` sequences remain in the cleaned path. The resulting path is then passed to `currentFS.Open(...)`. When the filesystem is left at the default (nil), Echo uses `defaultFS` which calls `os.Open` (`echo.go:792`). On Windows, `os.Open` treats `\` as a path separator and resolves `..\`, allowing traversal outside the static root. Version 5.0.3 fixes the issue.
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25766",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-19T19:45:33.220477Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T19:46:01.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "echo",
"vendor": "labstack",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.0.0, \u003c 5.0.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo\u2019s `middleware.Static` using the default filesystem allows path traversal via backslashes, enabling unauthenticated remote file read outside the static root. In `middleware/static.go`, the requested path is unescaped and normalized with `path.Clean` (URL semantics). `path.Clean` does not treat `\\` as a path separator, so `..\\` sequences remain in the cleaned path. The resulting path is then passed to `currentFS.Open(...)`. When the filesystem is left at the default (nil), Echo uses `defaultFS` which calls `os.Open` (`echo.go:792`). On Windows, `os.Open` treats `\\` as a path separator and resolves `..\\`, allowing traversal outside the static root. Version 5.0.3 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-19T15:49:02.402Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/labstack/echo/security/advisories/GHSA-pgvm-wxw2-hrv9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/labstack/echo/security/advisories/GHSA-pgvm-wxw2-hrv9"
},
{
"name": "https://github.com/labstack/echo/pull/2891",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/pull/2891"
},
{
"name": "https://github.com/labstack/echo/commit/b1d443086ea27cf51345ec72a71e9b7e9d9ce5f1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/labstack/echo/commit/b1d443086ea27cf51345ec72a71e9b7e9d9ce5f1"
}
],
"source": {
"advisory": "GHSA-pgvm-wxw2-hrv9",
"discovery": "UNKNOWN"
},
"title": "Echo has a Windows path traversal via backslash in middleware.Static default filesystem"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-25766",
"datePublished": "2026-02-19T15:49:02.402Z",
"dateReserved": "2026-02-05T18:35:52.358Z",
"dateUpdated": "2026-02-19T19:46:01.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}