Origin Validation Error

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Origin Validation Error via the ToMiddleware function in the Echo proxy middleware. When EchoIPExtractor is unset, an attacker can bypass upstream IP-based access...

LabStack Echo improper exception handling vulnerability

In LabStack Echo versions 5.0.0 through 5.4.1, there is an improper exception handling vulnerability. This occurs when the capture limit of the BodyDump middleware falls below the BodyLimit threshold; as a result, unknown-length requests are ignored, and any read errors or BodyLimit overflow erro...

LabStack Echo resource management error vulnerability

LabStack versions 4.15.0 through 4.16.1 and 5.0.0 through 5.4.1 contain a resource management error vulnerability. This vulnerability arises because the Proxy middleware retains handlers, copy goroutines, and network connections even after WebSocket clients have disconnected. The original proxy...

LabStack Echo input validation error vulnerability

Versions of LabStack Echo prior to 4.16.0 and from 5.0.0 up to 5.4.0 contain an input validation error vulnerability. This vulnerability arises because Context.Scheme unconditionally trusts protocol headers forwarded by any client, potentially allowing attackers to bypass HTTPS Redirects by...

LabStack Echo input validation error vulnerability

Versions of LabStack Echo prior to 4.15.2 and from 5.0.0 up to 5.1.1 contain an input validation error vulnerability. This vulnerability arises because Context.Scheme fails to validate whether X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme correspond to a supported web scheme. WWWRedire...

LabStack Echo Trust Management issue vulnerability

In LabStack Echo versions 5.0.0 through 5.4.1, there is a trust management vulnerability. This vulnerability arises from ExtractIPFromRealIPHeader’s validation of whether the X-Real-IP value provided by the client falls within a trusted range; it does not directly verify the network endpoint...

LabStack Echo input validation error vulnerability

Versions of LabStack Echo prior to 4.16.0 and from 5.0.0 up to 5.4.0 contain a security vulnerability. This vulnerability arises because the globally mounted middleware.Static instance fails to align its parsing of encoded request paths with those of the Echo router. The router still matches...

LabStack Echo authorization issue vulnerability

In versions 4.0.0 through 5.1.0 of LabStack Echo, there is an authorization issue vulnerability. This occurs because when Echo.IPExtractor is not configured, Context.RealIP falls back to the X-Forwarded-For or X-Real-IP values provided by the client. By default, the RateLimiter uses these values ...

LabStack Echo resource management error vulnerability

In LabStack Echo versions from 4.0.0 up to but including 4.16.1, there is a resource management error vulnerability. This vulnerability arises because the Decompress middleware fails to limit the size of the request body after gzip decompression. As a result, small-compressed requests can be...

CVE-2026-118652: Improper Neutralization of Input During Web Page Generation

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripti...

LabStack Echo input validation error vulnerability

In LabStack Echo versions 4.0.0 through 5.4.0, there is an input validation error vulnerability. This occurs because when Echo.IPExtractor is not configured, the Proxy middleware retains the X-Real-IP header provided by attackers and forwards it to upstream services. As a result, these services m...

LabStack Echo cross-site scripting vulnerability

Versions prior to 4.16.0 and versions 5.0.0 through 5.4.0 of LabStack Echo contain a cross-site scripting vulnerability. This vulnerability arises because Context.JSONP and Context.JSONPBlob concatenate unvalidated callback values into JavaScript responses; the jsonPBlob path fails to validate or...

CVE-2026-118260: Uncontrolled Resource Consumption

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDum...

LabStack Echo input validation error vulnerability

Versions prior to 4.15.3 and versions 5.0.0 through 5.2.0 of LabStack Echo contain an input validation error vulnerability. This vulnerability arises because middleware.Static performs a secondary decoding on already decoded Request.URL.Path; the encoded delimiter is reconstructed before file...

LabStack Echo input validation error vulnerability

A security vulnerability exists in LabStack Echo versions prior to 4.0.0 and 4.16.1, as well as versions prior to 5.0.0 and 5.4.1. This vulnerability arises because the Proxy middleware accepts WebSocket upgrade requests from clients before validating configuration; it selects the original tunnel...

CVE-2026-118653: Authentication Bypass by Spoofing

Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address valu...

CVE-2026-118656: URL Redirection to Untrusted Site

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separato...

LabStack Echo resource management error vulnerability

In LabStack Echo versions from 4.0.0 up to but including 4.16.1, there is a resource management error vulnerability. This vulnerability arises because the BodyDump middleware reads the entire request body into memory prior to processing it, without any limit on how long the full response body can...

Missing Release of Resource after Effective Lifetime

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the Proxy middleware. An attacker can exhaust system resources by repeatedly establishing WebSocket...

Missing Release of Resource after Effective Lifetime

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the Proxy middleware. An attacker can exhaust system resources by repeatedly establishing WebSocket...