LA
Vendor
labstack
20
CVEs
0
On KEV
16
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118658 New | EC echo labstack | 4.7 | Oct 28 | Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto |
| CVE-2026-118657 New | EC echo labstack | 5.9 | Oct 28 | Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers |
| CVE-2026-118656 New | EC echo labstack | 6.1 | Oct 28 | Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI |
| CVE-2026-118655 New | EC echo labstack | 5.9 | Oct 28 | Echo: Static Middleware Double-Unescape Path Traversal |
| CVE-2026-118654 New | EC echo labstack | 5.9 | Oct 28 | Echo static file middleware route protection bypass via encoded dot-dot traversal |
| CVE-2026-118653 New | EC echo labstack | 5.3 | Oct 28 | Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration |
| CVE-2026-118652 New | EC echo labstack | 6.1 | Oct 28 | Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob |
| CVE-2026-118651 New | EC echo labstack | 5.3 | Oct 28 | Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default |
| CVE-2026-118650 New | EC echo labstack | 7.5 | Oct 28 | Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path |
| CVE-2026-118266 New | EC echo labstack | 5.3 | Oct 28 | Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method |
| CVE-2026-118265 New | EC echo labstack | 5.3 | Oct 28 | Echo: X-Real-IP extractor trusts the header value instead of the sending peer |
| CVE-2026-118264 New | EC echo labstack | 9.1 | Oct 28 | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls |
| CVE-2026-118263 New | EC echo labstack | 6.3 | Oct 28 | Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests |
| CVE-2026-118262 New | EC echo labstack | 8.2 | Oct 28 | Echo: WebSocket proxy can retain connections and handlers after client disconnect |
| CVE-2026-118261 New | EC echo labstack | 8.2 | Oct 28 | Echo: Decompress permits unbounded gzip expansion in v4 |
| CVE-2026-118260 New | EC echo labstack | 8.2 | Oct 28 | Echo: BodyDump captures request and response bodies without size limits in v4 |
| CVE-2026-55677 | EC echo labstack | 7.5 | Jun 26 | Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files |
| CVE-2026-25766 | EC echo labstack | 5.3 | Feb 19 | Echo has a Windows path traversal via backslash in middleware.Static default filesystem |
| CVE-2020-36565 | EC Echo Labstack | 5.3 | Dec 7 | Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory… |
| CVE-2022-40083 | EC Echo Labstack | 9.6 | Sep 28 | Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component |