CVE-2026-118658 | Medium | 4.7 | 2026-10-28 | Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without vali… |
CVE-2026-118657 | Medium | 5.9 | 2026-10-28 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Ec… |
CVE-2026-118656 | Medium | 6.1 | 2026-10-28 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with… |
CVE-2026-118655 | Medium | 5.9 | 2026-10-28 | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separator… |
CVE-2026-118654 | Medium | 5.9 | 2026-10-28 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a p… |
CVE-2026-118653 | Medium | 5.3 | 2026-10-28 | Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is u… |
CVE-2026-118652 | Medium | 6.1 | 2026-10-28 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response… |
CVE-2026-118651 | Medium | 5.3 | 2026-10-28 | Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream servi… |
CVE-2026-118650 | High | 7.5 | 2026-10-28 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Ech… |
CVE-2026-118266 | Medium | 5.3 | 2026-10-28 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. W… |
CVE-2026-118265 | Medium | 5.3 | 2026-10-28 | Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trus… |
CVE-2026-118264 | | | 2026-10-28 | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before veri… |
CVE-2026-118263 | | | 2026-10-28 | Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when Bod… |
CVE-2026-118262 | | | 2026-10-28 | Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a… |
CVE-2026-118261 | | | 2026-10-28 | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded… |
CVE-2026-118260 | | | 2026-10-28 | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and ret… |
CVE-2026-55677 | High | 7.5 | 2026-06-26 | Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the… |
CVE-2026-25766 | Medium | 5.3 | 2026-02-19 | Echo is a Go web framework. In versions 5.0.0 through 5.0.2 on Windows, Echo’s `middleware.Static` using the default filesystem allows path traversal via backs… |
CVE-2020-36565 | Medium | 5.3 | 2022-12-07 | Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of th… |
CVE-2022-40083 | Critical | 9.6 | 2022-09-28 | Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attacker… |