Security advisories

medium2026-10-23

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

GHSA-h53f-rm2w-w7rg

high2026-10-23

Echo: WebSocket proxy can retain connections and handlers after client disconnect

GHSA-9969-6676-49h5

high2026-10-23

Echo: Decompress permits unbounded gzip expansion in v4

GHSA-h7wr-284f-5qvc

critical2026-10-23

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

GHSA-cxf3-9h37-7rr8

medium2026-10-23

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

GHSA-x9ff-22gv-65f4

high2026-10-23

Echo: BodyDump captures request and response bodies without size limits in v4

GHSA-f48p-c9v4-h7xv

high2026-08-25

Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files

GHSA-vfp3-v2gw-7wfq · CVE-2026-55677

medium2026-02-17

Echo has a Windows path traversal via backslash in middleware.Static default filesystem

GHSA-pgvm-wxw2-hrv9 · CVE-2026-25766

medium2022-12-07

Echo vulnerable to directory traversal

GHSA-j453-hm5x-c46w · CVE-2020-36565

critical2022-09-29

Labstack Echo Open Redirect vulnerability

GHSA-crxj-hrmp-4rwf · CVE-2022-40083