labstack echo

• CVE-2026-118658 Medium 4.7 Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto 0.2%
• CVE-2026-118657 Medium 5.9 Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers 0.1%
• CVE-2026-118656 Medium 6.1 Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI 0.2%
• CVE-2026-118655 Medium 5.9 Echo: Static Middleware Double-Unescape Path Traversal 0.3%
• CVE-2026-118654 Medium 5.9 Echo static file middleware route protection bypass via encoded dot-dot traversal 0.3%
• CVE-2026-118653 Medium 5.3 Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration 0.4%
• CVE-2026-118652 Medium 6.1 Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob 0.2%
• CVE-2026-118651 Medium 5.3 Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default 0.2%
• CVE-2026-118650 High 7.5 Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path 0.4%
• CVE-2026-118266 Medium 5.3 Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method 0.2%
• CVE-2026-118265 Medium 5.3 Echo: X-Real-IP extractor trusts the header value instead of the sending peer 0.1%
• CVE-2026-118264 Critical 9.1 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls 0.4%
• CVE-2026-118263 Medium 6.3 Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests 0.4%
• CVE-2026-118262 High 8.2 Echo: WebSocket proxy can retain connections and handlers after client disconnect 0.3%
• CVE-2026-118261 High 8.2 Echo: Decompress permits unbounded gzip expansion in v4 0.4%
• CVE-2026-118260 High 8.2 Echo: BodyDump captures request and response bodies without size limits in v4 0.4%
• CVE-2026-55677 High 7.5 Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files 0.5%
• CVE-2026-25766 Medium 5.3 Echo has a Windows path traversal via backslash in middleware.Static default filesystem 0.4%