Repository navigation
Security: labstack/echo
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Static route-guard bypass through encoded empty path segments in non-default Echo v5 configurationsGHSA-v97q-3xf5-rj74 published
Oct 30, 2026 by vishrModerate -
BodyDump can discard BodyLimit overflow errors for unknown-length requestsGHSA-x9ff-22gv-65f4 published
Oct 22, 2026 by vishrModerate -
Rejected WebSocket upgrades can bypass Echo route-level access controlsGHSA-cxf3-9h37-7rr8 published
Oct 22, 2026 by vishrCritical -
BodyDump captures request and response bodies without size limits in v4GHSA-f48p-c9v4-h7xv published
Oct 22, 2026 by vishrModerate -
Decompress permits unbounded gzip expansion in v4GHSA-h7wr-284f-5qvc published
Oct 22, 2026 by vishrModerate -
WebSocket proxy can retain connections and handlers after client disconnectGHSA-9969-6676-49h5 published
Oct 22, 2026 by vishrModerate -
X-Real-IP extractor trusts the header value instead of the sending peerGHSA-h53f-rm2w-w7rg published
Oct 22, 2026 by vishrModerate -
Open Redirect via Control-Character Prefix Defeating sanitizeURIGHSA-v753-g4cw-jm48 published
Sep 27, 2026 by vishrModerate -
middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path (incomplete fix of CVE-2026-55677); `EnablePathUnescaping` docstring over-promisesGHSA-375p-5qhx-8wq4 published
Sep 27, 2026 by vishrHigh -
Echo static file middleware route protection bypass via encoded dot-dot traversalGHSA-3pmx-cf9f-34xr published
Sep 27, 2026 by vishrModerate