Product by Labstack
Echo
20 known vulnerabilities in Echo (Labstack), 0 of them actively exploited (CISA KEV).
Key figures
20
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2022-40083 | Labstack Echo: Server-Side Request Forgery (SSRF) | 9.6 | |
| Critical | CVE-2026-118264 | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls | — | |
| High | CVE-2026-118261 | Echo: Decompress permits unbounded gzip expansion in v4 | — | |
| High | CVE-2026-118260 | Echo: BodyDump captures request and response bodies without size limits in v4 | — | |
| High | CVE-2026-118650 | Labstack Echo: Improper Handling of URL Encoding (Hex Encoding) | 7.5 | |
| High | CVE-2026-118262 | Echo: WebSocket proxy can retain connections and handlers after client disconnect | — | |
| High | CVE-2026-55677 | Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files | 7.5 | |
| Medium | CVE-2020-36565 | Directory traversal on Windows in github.com/labstack/echo/v4 | 5.3 | |
| Medium | CVE-2026-118263 | Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests | — | |
| Medium | CVE-2026-118653 | Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration | 5.3 | |
| Medium | CVE-2026-118654 | Echo static file middleware route protection bypass via encoded dot-dot traversal | 5.9 | |
| Medium | CVE-2026-118655 | Echo: Static Middleware Double-Unescape Path Traversal | 5.9 | |
| Medium | CVE-2026-118652 | Labstack Echo: Cross-site Scripting | 6.1 | |
| Medium | CVE-2026-118656 | Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI | 6.1 | |
| Medium | CVE-2026-118657 | Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers | 5.9 | |
| Medium | CVE-2026-118651 | Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default | 5.3 | |
| Medium | CVE-2026-118266 | Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method | 5.3 | |
| Medium | CVE-2026-118265 | Echo: X-Real-IP extractor trusts the header value instead of the sending peer | 5.3 | |
| Medium | CVE-2026-118658 | Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto | 4.7 | |
| Medium | CVE-2026-25766 | Echo has a Windows path traversal via backslash in middleware.Static default filesystem | 5.3 |