github.com/labstack/echo/v4 vulnerabilities

CVEs whose affected-version data names the github.com/labstack/echo/v4 package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

github.com/labstack/echo/v4 vulnerabilities

Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto

Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI

Echo has a Static Middleware Double-Unescape Path Traversal

Echo static file middleware route protection bypass via encoded dot-dot traversal

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Echo: Decompress permits unbounded gzip expansion in v4

Echo: BodyDump captures request and response bodies without size limits in v4

Echo: WebSocket proxy can retain connections and handlers after client disconnect

Echo: BodyDump captures request and response bodies without size limits in v4

Echo: Decompress permits unbounded gzip expansion in v4

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Echo: WebSocket proxy can retain connections and handlers after client disconnect