{"kind": "product", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "name": "golang-github-labstack-echo", "product": "golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS", "items": [{"id": "CVE-2026-118658", "noindex": false, "published": "2026-10-28T20:17:11.083Z", "modified": "2026-10-28T20:17:11.083Z", "cvss": 4.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00186, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118658", "title": "Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto", "description": "Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj", "https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181", "https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118657", "noindex": false, "published": "2026-10-28T20:14:09.883Z", "modified": "2026-10-28T20:14:09.883Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N", "severity": "medium", "epss": 0.00133, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118657", "title": "Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers", "description": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p", "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1", "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118656", "noindex": false, "published": "2026-10-28T20:12:13.757Z", "modified": "2026-10-29T17:23:39.728Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00197, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118656", "title": "Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI", "description": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48", "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1", "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118655", "noindex": false, "published": "2026-10-28T20:03:56.897Z", "modified": "2026-10-29T18:29:50.622Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00303, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118655", "title": "Echo: Static Middleware Double-Unescape Path Traversal", "description": "Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guarded route when the static middleware is registered globally. This issue is fixed in 4.15.3 and 5.2.0.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96", "https://github.com/labstack/echo/issues/2599", "https://github.com/labstack/echo/pull/3006"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118654", "noindex": false, "published": "2026-10-28T19:59:27.911Z", "modified": "2026-10-28T19:59:27.911Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00347, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118654", "title": "Echo static file middleware route protection bypass via encoded dot-dot traversal", "description": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read files that an application intended to protect with route-level middleware, when those files are also reachable through a static filesystem mount after path normalization. This vulnerability is the result of an incomplete fix for CVE-2026-55677. This issue is fixed in 4.16.0 and 5.4.0.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr", "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1", "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118653", "noindex": false, "published": "2026-10-28T19:42:05.556Z", "modified": "2026-10-28T19:42:05.556Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00415, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118653", "title": "Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration", "description": "Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling used for controls such as brute-force or request-volume protection. This issue is fixed in Echo v5.1.0.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq", "https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2", "https://github.com/labstack/echo/releases/tag/v5.1.0"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118652", "noindex": false, "published": "2026-10-28T19:35:47.103Z", "modified": "2026-10-28T19:35:47.103Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00239, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118652", "title": "Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob", "description": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response. A route that passes attacker-controlled input as the callback can return executable script syntax, allowing reflected cross-site scripting when a user loads the crafted response. The vulnerable jsonPBlob path performs no callback validation or escaping, and exploitation requires an application route that exposes attacker control over the callback argument. This issue is fixed in 4.16.0 and 5.4.0.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g", "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1", "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118651", "noindex": false, "published": "2026-10-28T19:30:01.320Z", "modified": "2026-10-29T20:53:54.404Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00207, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118651", "title": "Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default", "description": "Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address, undermining IP-based access controls, rate limiting, audit logging, or geographic restrictions that trust Echo's forwarded identity. This issue is fixed in Echo 5.4.0.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36", "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af", "https://github.com/labstack/echo/releases/tag/v5.4.0"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118650", "noindex": false, "published": "2026-10-28T19:25:02.952Z", "modified": "2026-10-28T19:25:02.952Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00396, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118650", "title": "Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path", "description": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash resolving to a file under the static root through the global static middleware, but the source is internally inconsistent about whether a route or group guard protects the corresponding literal path in that global-mount configuration. This issue is fixed in 4.16.0 and 5.4.0.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-375p-5qhx-8wq4", "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1", "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118266", "noindex": false, "published": "2026-10-28T19:21:47.729Z", "modified": "2026-10-28T19:21:47.729Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "severity": "medium", "epss": 0.00163, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118266", "title": "Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method", "description": "Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. When MethodOverride is registered before CSRF in the post-routing middleware chain, route selection retains the original state-changing POST handler but the override changes the method before CSRF evaluates it, causing both token validation and Sec-Fetch-Site checks to be skipped. A cross-site exploit requires an authenticated victim and an override value that a browser-submitted request can control, such as the form getter used by the advisory reproducer; the default X-HTTP-Method-Overr", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4", "https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1", "https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118265", "noindex": false, "published": "2026-10-28T19:03:56.934Z", "modified": "2026-10-29T20:54:10.718Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00139, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118265", "title": "Echo: X-Real-IP extractor trusts the header value instead of the sending peer", "description": "Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trusted range instead of validating the direct network peer. A client reaching Echo directly, or through a proxy that preserves the header, can supply a loopback or private address and have Context.RealIP return that spoofed identity. Applications using the extractor for IP allowlists, rate limiting, audit logs, or forwarding headers can consequently trust an attacker-controlled address; the default direct extractor and Echo v4 are unaffected. This issue is fixed in 5.4.1.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-h53f-rm2w-w7rg", "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaae", "https://github.com/labstack/echo/releases/tag/v5.4.1"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118264", "noindex": false, "published": "2026-10-28T19:03:01.533Z", "modified": "2026-10-28T19:03:01.533Z", "cvss": 9.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.0043, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118264", "title": "Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls", "description": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. Thi", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8", "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec", "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118263", "noindex": false, "published": "2026-10-28T19:01:30.268Z", "modified": "2026-10-28T19:01:30.268Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00385, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118263", "title": "Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests", "description": "Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-x9ff-22gv-65f4", "https://github.com/labstack/echo/pull/3105", "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118262", "noindex": false, "published": "2026-10-28T19:00:12.315Z", "modified": "2026-10-28T19:00:12.315Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00302, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118262", "title": "Echo: WebSocket proxy can retain connections and handlers after client disconnect", "description": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5", "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec", "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118261", "noindex": false, "published": "2026-10-28T18:58:43.504Z", "modified": "2026-10-29T20:54:55.973Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118261", "title": "Echo: Decompress permits unbounded gzip expansion in v4", "description": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-h7wr-284f-5qvc", "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f", "https://github.com/labstack/echo/releases/tag/v4.16.1"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-118260", "noindex": false, "published": "2026-10-28T18:56:56.747Z", "modified": "2026-10-28T18:56:56.747Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-118260", "title": "Echo: BodyDump captures request and response bodies without size limits in v4", "description": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv", "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f", "https://github.com/labstack/echo/releases/tag/v4.16.1"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2026-55677", "noindex": false, "published": "2026-06-26T16:15:55.633Z", "modified": "2026-06-26T16:50:57.019Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00519, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-55677", "title": "Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files", "description": "Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vulnerability is fixed in 4.15.3 and 5.2.0.", "references": ["https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq", "https://nvd.nist.gov/vuln/detail/CVE-2026-55677"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2020-36565", "noindex": false, "published": "2022-12-07T16:14:43.946Z", "modified": "2025-04-23T15:38:30.467Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.01413, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2020-36565", "title": "Directory traversal on Windows in github.com/labstack/echo/v4", "description": "Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read.", "references": ["https://github.com/labstack/echo/pull/1718", "https://github.com/labstack/echo/commit/4422e3b66b9fd498ed1ae1d0242d660d0ed3faaa", "https://pkg.go.dev/vuln/GO-2021-0051"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}, {"id": "CVE-2022-40083", "noindex": false, "published": "2022-09-28T13:34:03.000Z", "modified": "2025-05-21T14:40:33.654Z", "cvss": 9.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.03238, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-40083", "title": "CVE-2022-40083", "description": "Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).", "references": ["https://github.com/labstack/echo/issues/2259", "https://nvd.nist.gov/vuln/detail/CVE-2022-40083"], "fixes": [], "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}]}], "total": 19, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "golang-github-labstack-echo", "path": "vulns/ubuntu-22.04-lts/golang-github-labstack-echo", "ecosystem": "Ubuntu:22.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 16, "kev": 0}, "lastmod": "2026-10-29T20:54:55.973Z", "early_advisories": [], "license": "Puedes utilizar libremente la selección de PatchFirst y nuestras aportaciones (prioridades, alertas tempranas, textos, resúmenes y agregados) para tus propios fines, incluido el uso interno de tu empresa. La reventa, la distribución comercial y la creación masiva de réplicas de esta selección o de estas aportaciones requieren un acuerdo escrito con el operador. Siempre que uses o publiques la selección o nuestras aportaciones, cita a PatchFirst (https://patchfirst.dev/vulns/) con este enlace a la página del flujo de tu región. Los registros originales de fuentes abiertas siguen sujetos a sus respectivas licencias y condiciones. Estas condiciones no limitan tus derechos sobre los datos originales, que puedes obtener directamente de esas fuentes.", "terms_url": "https://patchfirst.dev/es/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst selecciona, normaliza y combina los registros; se pueden añadir resúmenes y traducciones. Las noticias incluyen un enlace a la fuente original en cada entrada.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Las licencias de las bases originales varían; consulta el catálogo de fuentes."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Puntuaciones públicas gratuitas; se solicita atribución (FIRST EPSS, puntuaciones generadas por Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}