Improper Handling of Highly Compressed Data (Data Amplification)

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the Decompress middleware. An attacker can exhaust memory or CPU resources by sending a small,...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the Decompress middleware. An attacker can exhaust memory or CPU resources by sending a small,...

Allocation of Resources Without Limits or Throttling

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the BodyDump middleware. An attacker can exhaust process memory and disrupt service availability by...

Allocation of Resources Without Limits or Throttling

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the BodyDump middleware. An attacker can exhaust process memory and disrupt service availability by...

CLSA-2026-1790972556 osbuild-composer: Fix of CVE-2026-55677

CVE-2026-55677: stop unescaping the static file wildcard by default in Static, StaticFS, Group.StaticFS and StaticWithConfig of the vendored github.com/labstack/echo/v4 the echo v4.15.4 fix, so an encoded separator %2F, %5C or dot-segment %2E%2E cannot resolve a static file outside the route the...

CLSA-2026-1790266264 osbuild-composer: Fix of CVE-2026-55677

CVE-2026-55677: reject percent-encoded path separators %2F, %5C in the static file wildcard before unescaping it, in StaticDirectoryHandler and StaticWithConfig of the vendored github.com/labstack/echo/v4, so that an encoded separator cannot smuggle a path segment past the router and disclose a...

ROOT-APP-GOBINARY-CVE-2026-55677 CVE-2026-55677 in github.com/labstack/echo/v4 - Patched by Root

Root has patched CVE-2026-55677 in the github.com/labstack/echo/v4 package for Root:Go. Multiple fixed versions available...

RockyLinux 9 : osbuild-composer (RLSA-2026:69293)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69293 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...

GO-2026-6293 Encoded slash (%2F) bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5

Encoded slash %2F bypasses route-level protection and exposes static files in github.com/labstack/echo/v4 and github.com/labstack/echo/v5...

GO-2026-4502 Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5

Echo has a Windows path traversal via backslash in middleware.Static default filesystem in github.com/labstack/echo/v5...

CVE-2022-40083

Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery SSRF...

Linux Distros Unpatched Vulnerability : CVE-2022-40083

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers...

CVE-2020-36565

Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...

CVE-2020-36565 Directory traversal on Windows in github.com/labstack/echo/v4

Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...

LabStack Echo: Path traversal vulnerability

labstack echo is the high-performance, minimalist Go Web framework. A security vulnerability exists in the previous version of labstack echo v4.1.18-0.20201215153152-4422e3b66b9f, which stems from incorrect cleanup of user input on Windows, where the static file handler allows for directory...

GO-2022-1031 Open redirect in github.com/labstack/echo/v4

Labstack Echo contains an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery SSRF...

Server-Side Request Forgery (SSRF)

github.com/labstack/echo is vulnerable to server side request forgery. The vulnerability exists due to a lack of sanitization of URL via the Static Handler component allowing an attacker to redirect a user to a malicious website...

LabStack Echo Open Redirect Vulnerability

LabStack echo is a high-performance, minimalist Go web framework open sourced by LabStack LLC. labStack Echo v4.8.0 version has an open redirection vulnerability that can be exploited by attackers to launch server-side request forgery attacks...

Labstack Echo Open Redirect vulnerability

Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery SSRF. Version 4.9.0 contains a patch for the issue...

GHSA-CRXJ-HRMP-4RWF Labstack Echo Open Redirect vulnerability

Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery SSRF. Version 4.9.0 contains a patch for the issue...