CVE-2026-55677

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...

CVE-2026-55677 Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...

CVE-2026-55677

Echo (Go framework) prior to 4.15.3 and 5.2.0 has a router vs static file handler decoding mismatch: the router uses the raw encoded path while StaticDirectoryHandler unescapes %2F to /, enabling bypass of route-level access controls to read static files without authorization. The vulnerability i...

CVE-2026-55677

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...

ECHO-2EBB-8255-512C

Bulletin has no description...

ECHO-36E6-1A60-39DB

Bulletin has no description...

ECHO-31D3-7C0E-C6D2

Bulletin has no description...

ECHO-E71E-279B-37A1

Bulletin has no description...

ECHO-090A-B306-0693

Bulletin has no description...

ECHO-B8E1-3EC5-6440

Bulletin has no description...

ECHO-B0B6-3E4E-5537

Bulletin has no description...

ECHO-8BA3-8FB1-8BF3

Bulletin has no description...

ECHO-095F-9212-0D42

Bulletin has no description...

ECHO-F12B-6676-395C

Bulletin has no description...

ECHO-2158-5503-61C4

Bulletin has no description...

ECHO-CD1D-69C8-523B

Bulletin has no description...

ECHO-B6CA-60DD-BABD

Bulletin has no description...

ECHO-AA60-5448-7B0C

Bulletin has no description...

SUSE CVE-2026-53208

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig net/bluetooth/l2capcore.c:l2capsigchannel accepts BR/EDR signaling packets up to the channel MTU and dispatches each command without enforcing the signaling MTU MTUsig...

SUSE CVE-2026-53246

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIEECHO processing When a listening SCTP server processes a COOKIEECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked b...