Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/labstack/echo/v5

19 known vulnerabilities (1 critical, 3 high, 12 medium), with the versions each affects and the releases that fix them.

Latest release
v5.4.4 (Oct 30, 2026): no advisory affects it
Newest unaffected release
v5.4.4 (Oct 30, 2026), the latest release
Advisories
19 · 1 critical, 3 high, 12 medium
Releases
16 since v5.0.0 (Jan 18, 2026)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 19 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 19

  • Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

    Affected: from 5.0.0, fixed in 5.4.1.

    Fixed in v5.4.1 (released Oct 22, 2026, 14 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

    Affected: from 5.0.0, fixed in 5.4.1.

    Fixed in v5.4.1 (released Oct 22, 2026, 14 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

    Affected: from 5.0.0, fixed in 5.4.1.

    Fixed in v5.4.1 (released Oct 22, 2026, 14 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • CVE-2026-118658Medium 4.7

    Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

    Affected: fixed in 5.1.1.

    Fixed in v5.1.1 (released May 1, 2026, 180 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • CVE-2026-118657Medium 5.9

    Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

    Affected: fixed in 5.4.0.

    Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • CVE-2026-118656Medium 6.1

    Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI

    Affected: fixed in 5.4.0.

    Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • CVE-2026-118655Medium 5.9

    Echo: Static Middleware Double-Unescape Path Traversal

    Affected: fixed in 5.2.0.

    Fixed in v5.2.0 (released Jun 14, 2026, 136 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • CVE-2026-118654Medium 5.9

    Echo static file middleware route protection bypass via encoded dot-dot traversal

    Affected: fixed in 5.4.0.

    Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • CVE-2026-118653Medium 5.3

    Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

    Affected: fixed in 5.1.0.

    Fixed in v5.1.0 (released Mar 31, 2026, 211 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • CVE-2026-118652Medium 6.1

    Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

    Affected: fixed in 5.4.0.

    Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • CVE-2026-118651Medium 5.3

    Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

    Affected: fixed in 5.4.0.

    Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

    Affected: fixed in 5.4.0; from 5.0.0, fixed in 5.4.0.

    Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • CVE-2026-118266Medium 5.3

    Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

    Affected: from 5.0.0, fixed in 5.4.0.

    Fixed in v5.4.0 (released Sep 27, 2026, 31 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • CVE-2026-118265Medium 5.3

    Echo: X-Real-IP extractor trusts the header value instead of the sending peer

    Affected: from 5.0.0, fixed in 5.4.1.

    Fixed in v5.4.1 (released Oct 22, 2026, 6 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • CVE-2026-118264Critical 9.1

    Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

    Affected: from 5.0.0, fixed in 5.4.1.

    Fixed in v5.4.1 (released Oct 22, 2026, 6 days before disclosure).

    The latest release, v5.4.4, is not affected.

Show all 19 advisoriesShow fewer advisories
  • CVE-2026-118263Medium 6.3

    Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

    Affected: from 5.0.0, fixed in 5.4.1.

    Fixed in v5.4.1 (released Oct 22, 2026, 6 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • Echo: WebSocket proxy can retain connections and handlers after client disconnect

    Affected: from 5.0.0, fixed in 5.4.1.

    Fixed in v5.4.1 (released Oct 22, 2026, 6 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

    Affected: fixed in 5.2.0.

    Fixed in v5.2.0 (released Jun 14, 2026, 12 days before disclosure).

    The latest release, v5.4.4, is not affected.

  • CVE-2026-25766Medium 5.3

    Echo has a Windows path traversal via backslash in middleware.Static default filesystem

    Affected: from 5.0.0, fixed in 5.0.3.

    Fixed in v5.0.3 (released Feb 6, 2026, 13 days before disclosure).

    The latest release, v5.4.4, is not affected.