Technology · Go
github.com/labstack/echo/v5 (Go) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 20 vulnerabilities in github.com/labstack/echo/v5 (Go): 0 in the last 7 days and 18 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-118658, was published on 28 October 2026. 18 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0.
- Last 7 days
- 0
- Last 90 days
- 18
- Critical, all time
- 1
- Exploited in the wild
- 0
About github.com/labstack/echo/v5 (Go)
Go web framework providing HTTP request routing, middleware, and response handling (v5).
Latest github.com/labstack/echo/v5 (Go) vulnerabilities
- CVE-2026-118658: Echo web framework arbitrary URI scheme redirectmediumCVSS 4.7EPSS 0.2%
- CVE-2026-118657: Echo Go web framework scheme header spoofing and HSTS bypassmediumCVSS 5.9EPSS 0.1%
- CVE-2026-118656: Echo open redirect in sanitizeURI with trailing slash redirectmediumCVSS 6.1EPSS 0.2%
- CVE-2026-118655: Echo path traversal via double URL encoding in Static middlewaremediumCVSS 5.9EPSS 0.3%
- CVE-2026-118654: Echo path traversal in static file handlers via dot segment normalizationmediumCVSS 5.9EPSS 0.4%
- CVE-2026-118653: Echo Go web framework rate-limit bypass via spoofed IP headersmediumCVSS 5.3EPSS 0.4%
- CVE-2026-118652: Echo JSONP callback code injectionmediumCVSS 6.1EPSS 0.2%
- CVE-2026-118651: Echo Proxy middleware IP spoofing via X-Real-IP headermediumCVSS 5.3EPSS 0.2%
- CVE-2026-118650: Echo path traversal via encoded static file requestshighCVSS 7.5EPSS 0.4%
- CVE-2026-118266: Echo MethodOverride middleware CSRF bypassmediumCVSS 5.3EPSS 0.2%
- CVE-2026-118265: Echo X-Real-IP header spoofing via untrusted extractormediumCVSS 5.3EPSS 0.1%
- CVE-2026-118264: Echo Proxy middleware WebSocket upgrade validation bypassinfoEPSS 0.4%
- CVE-2026-118263: Echo BodyDump middleware body limit bypassinfoEPSS 0.4%
- CVE-2026-118262: Echo Proxy middleware resource retention and DoSinfoEPSS 0.3%
- Echo X-Real-IP header spoofing vulnerabilitymediumCVSS 5.3
- Echo WebSocket proxy resource retention after client disconnecthighCVSS 4
- Echo WebSocket upgrade authorization bypasscriticalCVSS 4
- Echo BodyDump middleware body limit bypassmediumCVSS 4
- CVE-2026-55677: Labstack Echo authorization bypass in static file handlerhighCVSS 7.5EPSS 0.4%
- CVE-2026-25766: Echo has a Windows path traversal via backslash in middleware.Static default filesystemlowCVSS 3.1EPSS 0.4%
Most severe github.com/labstack/echo/v5 (Go) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- Echo WebSocket upgrade authorization bypasscriticalCVSS 4
- CVE-2026-55677: Labstack Echo authorization bypass in static file handlerhighCVSS 7.5EPSS 0.4%
- CVE-2026-118650: Echo path traversal via encoded static file requestshighCVSS 7.5EPSS 0.4%
- Echo WebSocket proxy resource retention after client disconnecthighCVSS 4
- CVE-2026-118652: Echo JSONP callback code injectionmediumCVSS 6.1EPSS 0.2%
- CVE-2026-118656: Echo open redirect in sanitizeURI with trailing slash redirectmediumCVSS 6.1EPSS 0.2%
- CVE-2026-118654: Echo path traversal in static file handlers via dot segment normalizationmediumCVSS 5.9EPSS 0.4%
- CVE-2026-118655: Echo path traversal via double URL encoding in Static middlewaremediumCVSS 5.9EPSS 0.3%
- CVE-2026-118657: Echo Go web framework scheme header spoofing and HSTS bypassmediumCVSS 5.9EPSS 0.1%
- CVE-2026-118653: Echo Go web framework rate-limit bypass via spoofed IP headersmediumCVSS 5.3EPSS 0.4%
Vulnerabilities per week
18 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 4 | 1 | |
| 26 Oct 2026 | 14 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many github.com/labstack/echo/v5 (Go) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5)<a href="https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5"><img src="https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5/badge.svg" alt="github.com/labstack/echo/v5 (Go) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5.json, and this page as text at https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "github.com/labstack/echo/v5 (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5, 13 November 2026.