Labstack Echo 4.8.0 - Open Redirect

Labstack Echo 4.8.0 contains an open redirect vulnerability via the Static Handler component. An attacker can leverage this vulnerability to cause server-side request forgery, making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-400...

ROOT-APP-GOBINARY-GHSA-F48P-C9V4-H7XV GHSA-f48p-c9v4-h7xv in github.com/labstack/echo/v4 - Patched by Root

Root has patched GHSA-f48p-c9v4-h7xv in the github.com/labstack/echo/v4 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-GHSA-H7WR-284F-5QVC GHSA-h7wr-284f-5qvc in github.com/labstack/echo/v4 - Patched by Root

Root has patched GHSA-h7wr-284f-5qvc in the github.com/labstack/echo/v4 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-GHSA-CXF3-9H37-7RR8 GHSA-cxf3-9h37-7rr8 in github.com/labstack/echo/v4 - Patched by Root

Root has patched GHSA-cxf3-9h37-7rr8 in the github.com/labstack/echo/v4 package for Root:Go. Multiple fixed versions available...

CVE-2026-118260: Uncontrolled Resource Consumption

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDum...

LabStack Echo resource management error vulnerability

In LabStack Echo versions from 4.0.0 up to but including 4.16.1, there is a resource management error vulnerability. This vulnerability arises because the Decompress middleware fails to limit the size of the request body after gzip decompression. As a result, small-compressed requests can be...

CVE-2026-118656: URL Redirection to Untrusted Site

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separato...

CVE-2026-118653: Authentication Bypass by Spoofing

Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address valu...

CVE-2026-118652: Improper Neutralization of Input During Web Page Generation

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripti...

Missing Release of Resource after Effective Lifetime

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the Proxy middleware. An attacker can exhaust system resources by repeatedly establishing WebSocket...

Missing Release of Resource after Effective Lifetime

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the Proxy middleware. An attacker can exhaust system resources by repeatedly establishing WebSocket...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the Decompress middleware. An attacker can exhaust memory or CPU resources by sending a small,...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the Decompress middleware. An attacker can exhaust memory or CPU resources by sending a small,...

Allocation of Resources Without Limits or Throttling

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the BodyDump middleware. An attacker can exhaust process memory and disrupt service availability by...

Allocation of Resources Without Limits or Throttling

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the BodyDump middleware. An attacker can exhaust process memory and disrupt service availability by...

CLSA-2026-1790972556 osbuild-composer: Fix of CVE-2026-55677

CVE-2026-55677: stop unescaping the static file wildcard by default in Static, StaticFS, Group.StaticFS and StaticWithConfig of the vendored github.com/labstack/echo/v4 the echo v4.15.4 fix, so an encoded separator %2F, %5C or dot-segment %2E%2E cannot resolve a static file outside the route the...

CLSA-2026-1790266264 osbuild-composer: Fix of CVE-2026-55677

CVE-2026-55677: reject percent-encoded path separators %2F, %5C in the static file wildcard before unescaping it, in StaticDirectoryHandler and StaticWithConfig of the vendored github.com/labstack/echo/v4, so that an encoded separator cannot smuggle a path segment past the router and disclose a...

ROOT-APP-GOBINARY-CVE-2026-55677 CVE-2026-55677 in github.com/labstack/echo/v4 - Patched by Root

Root has patched CVE-2026-55677 in the github.com/labstack/echo/v4 package for Root:Go. Multiple fixed versions available...

RockyLinux 9 : osbuild-composer (RLSA-2026:69293)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69293 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...

GO-2026-6293 Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

Encoded slash %2F bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5...