258 matches found
CVE-2026-118264
A flaw was found in Echo's Proxy middleware. When a client requests a WebSocket upgrade, the middleware establishes a direct network tunnel before verifying whether the upstream server accepted the upgrade. If the upstream server rejects the upgrade while keeping the connection alive, subsequent...
CVE-2026-118651
A flaw was found in Echo. When the proxy middleware is used without an explicit IP extractor configured, it retains and forwards attacker-supplied X-Real-IP headers to upstream services. A remote attacker can exploit this vulnerability to spoof their client Internet Protocol IP address. This flaw...
CVE-2026-118262
A flaw was found in Echo's Proxy middleware. When handling WebSocket connections, the proxy fails to reliably close upstream network connections and terminate background processes after a client disconnects. A remote attacker can exploit this flaw by repeatedly opening and dropping connections,...
CLEANSTART-2026-HR24224 In http-proxy-middleware before 2
Security vulnerability affects the argo-workflows package. In http-proxy-middleware before 2...
CLEANSTART-2026-PU28802 In http-proxy-middleware before 2
Security vulnerability affects the argo-workflows package. In http-proxy-middleware before 2...
CLEANSTART-2026-FV33556 http-proxy-middleware is node
Security vulnerability affects the argo-workflows package. http-proxy-middleware is node...
CLEANSTART-2026-KF31657 http-proxy-middleware is node
Security vulnerability affects the argo-workflows package. http-proxy-middleware is node...
CVE-2026-118651
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
Linux Distros Unpatched Vulnerability : CVE-2026-118651
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream servic...
Linux Distros Unpatched Vulnerability : CVE-2026-118262
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a...
Linux Distros Unpatched Vulnerability : CVE-2026-118264
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before...
DEBIAN-CVE-2026-118651
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
CVE-2026-118651
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
CVE-2026-118651
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
UBUNTU-CVE-2026-118651
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
CVE-2026-118651 Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
CVE-2026-118651
The Echo Go web framework (versions 4.0.0 through 5.4.0 ) contains a vulnerability where the Proxy middleware forwards an attacker-supplied X-Real-IP header to upstream services by default. This occurs when Echo.IPExtractor is not configured, allowing a remote client to spoof their client address...
CVE-2026-118651 Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
CVE-2026-118651 Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
EUVD-2026-112406
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...