Login Request a demo
EC
Product
echo
by labstack · last CVE Oct 28, 2026
20
CVEs
0
On KEV
9.6
Max CVSS
16
New 30D
Vulnerabilities20In the news0Timeline
Severity mix
Critical 2High 5Medium 13Low 0
Severity
All severities20Critical2High5Medium13Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add echo to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-118262
New
8.2–Oct 28
Echo: WebSocket proxy can retain connections and handlers after client disconnect
Affected: >= 4.15.0, < 4.16.1; >= 5.0.0, < 5.4.1
CVE-2026-118261
New
8.2–Oct 28
Echo: Decompress permits unbounded gzip expansion in v4
Affected: >= 4.0.0, < 4.16.1
CVE-2026-118260
New
8.2–Oct 28
Echo: BodyDump captures request and response bodies without size limits in v4
Affected: >= 4.0.0, < 4.16.1
CVE-2026-118650
New
7.5–Oct 28
Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
Affected: >= 5.0.0, < 5.4.0; < 4.16.0
CVE-2026-55677
7.5
1%
Jun 26
Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files
Affected: < 4.15.3; >= 5.0.0, < 5.2.0
Showing 5