Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/labstack/echo/v4

21 known vulnerabilities (2 critical, 5 high, 10 medium), with the versions each affects and the releases that fix them.

Latest release
v4.16.3 (Oct 30, 2026): affected by 2 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
21 · 2 critical, 5 high, 10 medium
Releases
59 since v4.0.0 (Jan 30, 2019)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 21 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 21

  • Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo

    Affected: from 4.0.0, fixed in 4.16.1.

    Fixed in v4.16.1 (released Oct 22, 2026, 14 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

    Affected: from 4.0.0, fixed in 4.16.1.

    Fixed in v4.16.1 (released Oct 22, 2026, 14 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

    Affected: from 4.0.0, fixed in 4.16.1.

    Fixed in v4.16.1 (released Oct 22, 2026, 14 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

    Affected: from 4.15.0, fixed in 4.16.1.

    Fixed in v4.16.1 (released Oct 22, 2026, 14 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • CVE-2026-118658Medium 4.7

    Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

    Affected: fixed in 4.15.2.

    Fixed in v4.15.2 (released May 1, 2026, 180 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • CVE-2026-118657Medium 5.9

    Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

    Affected: fixed in 4.16.0.

    Fixed in v4.16.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • CVE-2026-118656Medium 6.1

    Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI

    Affected: fixed in 4.16.0.

    Fixed in v4.16.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • CVE-2026-118655Medium 5.9

    Echo: Static Middleware Double-Unescape Path Traversal

    Affected: fixed in 4.15.3.

    Fixed in v4.15.3 (released Jun 14, 2026, 136 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • CVE-2026-118654Medium 5.9

    Echo static file middleware route protection bypass via encoded dot-dot traversal

    Affected: fixed in 4.16.0.

    Fixed in v4.16.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • CVE-2026-118653Medium 5.3

    Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

    Affected: from 4.0.0, through 4.16.2; from 4.0.0.

    No fix released. The latest release, v4.16.3, is still affected.

  • CVE-2026-118652Medium 6.1

    Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

    Affected: fixed in 4.16.0.

    Fixed in v4.16.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • CVE-2026-118651Medium 5.3

    Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

    Affected: from 4.0.0, through 4.16.2; from 4.0.0.

    No fix released. The latest release, v4.16.3, is still affected.

  • Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

    Affected: fixed in 4.16.0.

    Fixed in v4.16.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • CVE-2026-118266Medium 5.3

    Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

    Affected: fixed in 4.16.0.

    Fixed in v4.16.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • CVE-2026-118264Critical 9.1

    Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

    Affected: from 4.0.0, fixed in 4.16.1.

    Fixed in v4.16.1 (released Oct 22, 2026, 6 days before disclosure).

    The latest release, v4.16.3, is not affected.

Show all 21 advisoriesShow fewer advisories

  • Echo: WebSocket proxy can retain connections and handlers after client disconnect

    Affected: from 4.15.0, fixed in 4.16.1.

    Fixed in v4.16.1 (released Oct 22, 2026, 6 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • Echo: Decompress permits unbounded gzip expansion in v4

    Affected: from 4.0.0, fixed in 4.16.1.

    Fixed in v4.16.1 (released Oct 22, 2026, 6 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • Echo: BodyDump captures request and response bodies without size limits in v4

    Affected: from 4.0.0, fixed in 4.16.1.

    Fixed in v4.16.1 (released Oct 22, 2026, 6 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

    Affected: fixed in 4.15.3.

    Fixed in v4.15.3 (released Jun 14, 2026, 12 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • CVE-2020-36565Medium 5.3

    Directory traversal on Windows in github.com/labstack/echo/v4

    Affected: fixed in 4.1.18-0.20201215153152-4422e3b66b9f; fixed in 4.2.0; fixed in 4.1.18-0.20201215153152-4422e3b66b9f.

    Fixed in v4.2.0 (released Feb 11, 2021, 664 days before disclosure).

    The latest release, v4.16.3, is not affected.

  • CVE-2022-40083Critical 9.6

    Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component.

    Affected: fixed in 4.9.0.

    Fixed in v4.9.0 (released Sep 4, 2022, 24 days before disclosure).

    The latest release, v4.16.3, is not affected.