Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Echo: WebSocket proxy can retain connections and handlers after client disconnect

Echo: Decompress permits unbounded gzip expansion in v4

Echo: BodyDump captures request and response bodies without size limits in v4

Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI

Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Echo: Static Middleware Double-Unescape Path Traversal

Echo static file middleware route protection bypass via encoded dot-dot traversal

Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

Echo has a Windows path traversal via backslash in middleware.Static default filesystem

Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory…

Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto