{"schema_version":1,"title":"github.com/labstack/echo/v5 (Go) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 20 vulnerabilities in github.com/labstack/echo/v5 (Go): 0 in the last 7 days and 18 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-118658, was published on 28 October 2026. 18 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0.","url":"https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5","json_url":"https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":3,"all_time":20,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":18,"last_90_days":18,"last_365_days":20},"latest":[{"cve":"CVE-2026-118658","cvss":4.7,"epss":0.0019,"slug":"cve-2026-118658-echo-is-a-go-web-framework-prior-to-4-15-2-and-5-1-1-context","title":"Echo web framework arbitrary URI scheme redirect","severity":"medium","exploited":false,"published_at":"2026-10-28T21:16:55.827+00:00","url":"https://junglewise.ai/threats/cve-2026-118658-echo-is-a-go-web-framework-prior-to-4-15-2-and-5-1-1-context"},{"cve":"CVE-2026-118657","cvss":5.9,"epss":0.0013,"slug":"cve-2026-118657-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context","title":"Echo Go web framework scheme header spoofing and HSTS bypass","severity":"medium","exploited":false,"published_at":"2026-10-28T21:16:55.693+00:00","url":"https://junglewise.ai/threats/cve-2026-118657-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context"},{"cve":"CVE-2026-118656","cvss":6.1,"epss":0.002,"slug":"cve-2026-118656-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-sanitizeuri","title":"Echo open redirect in sanitizeURI with trailing slash redirect","severity":"medium","exploited":false,"published_at":"2026-10-28T21:16:55.55+00:00","url":"https://junglewise.ai/threats/cve-2026-118656-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-sanitizeuri"},{"cve":"CVE-2026-118655","cvss":5.9,"epss":0.003,"slug":"cve-2026-118655-echo-is-a-go-web-framework-prior-to-4-15-3-and-5-2-0-middleware","title":"Echo path traversal via double URL encoding in Static middleware","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.723+00:00","url":"https://junglewise.ai/threats/cve-2026-118655-echo-is-a-go-web-framework-prior-to-4-15-3-and-5-2-0-middleware"},{"cve":"CVE-2026-118654","cvss":5.9,"epss":0.0035,"slug":"cve-2026-118654-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s","title":"Echo path traversal in static file handlers via dot segment normalization","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.55+00:00","url":"https://junglewise.ai/threats/cve-2026-118654-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s"},{"cve":"CVE-2026-118653","cvss":5.3,"epss":0.0042,"slug":"cve-2026-118653-echo-is-a-go-web-framework-from-4-0-0-until-5-1-0-context-realip","title":"Echo Go web framework rate-limit bypass via spoofed IP headers","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.4+00:00","url":"https://junglewise.ai/threats/cve-2026-118653-echo-is-a-go-web-framework-from-4-0-0-until-5-1-0-context-realip"},{"cve":"CVE-2026-118652","cvss":6.1,"epss":0.0024,"slug":"cve-2026-118652-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context","title":"Echo JSONP callback code injection","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.25+00:00","url":"https://junglewise.ai/threats/cve-2026-118652-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context"},{"cve":"CVE-2026-118651","cvss":5.3,"epss":0.0021,"slug":"cve-2026-118651-echo-is-a-go-web-framework-from-4-0-0-until-5-4-0-the-proxy","title":"Echo Proxy middleware IP spoofing via X-Real-IP header","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.073+00:00","url":"https://junglewise.ai/threats/cve-2026-118651-echo-is-a-go-web-framework-from-4-0-0-until-5-4-0-the-proxy"},{"cve":"CVE-2026-118650","cvss":7.5,"epss":0.004,"slug":"cve-2026-118650-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-a-globally","title":"Echo path traversal via encoded static file requests","severity":"high","exploited":false,"published_at":"2026-10-28T20:17:21.85+00:00","url":"https://junglewise.ai/threats/cve-2026-118650-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-a-globally"},{"cve":"CVE-2026-118266","cvss":5.3,"epss":0.0016,"slug":"cve-2026-118266-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s","title":"Echo MethodOverride middleware CSRF bypass","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:21.577+00:00","url":"https://junglewise.ai/threats/cve-2026-118266-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s"},{"cve":"CVE-2026-118265","cvss":5.3,"epss":0.0014,"slug":"cve-2026-118265-echo-is-a-go-web-framework-from-5-0-0-until-5-4-1-echo-v5-s","title":"Echo X-Real-IP header spoofing via untrusted extractor","severity":"medium","exploited":false,"published_at":"2026-10-28T19:17:31.377+00:00","url":"https://junglewise.ai/threats/cve-2026-118265-echo-is-a-go-web-framework-from-5-0-0-until-5-4-1-echo-v5-s"},{"cve":"CVE-2026-118264","epss":0.0043,"slug":"cve-2026-118264-echo-is-a-go-web-framework-from-4-0-0-until-4-16-1-and-5-4-1","title":"Echo Proxy middleware WebSocket upgrade validation bypass","severity":"info","exploited":false,"published_at":"2026-10-28T19:17:31.237+00:00","url":"https://junglewise.ai/threats/cve-2026-118264-echo-is-a-go-web-framework-from-4-0-0-until-4-16-1-and-5-4-1"},{"cve":"CVE-2026-118263","epss":0.0039,"slug":"cve-2026-118263-echo-is-a-go-web-framework-from-5-0-0-until-5-4-1-echo-v5-s","title":"Echo BodyDump middleware body limit bypass","severity":"info","exploited":false,"published_at":"2026-10-28T19:17:31.097+00:00","url":"https://junglewise.ai/threats/cve-2026-118263-echo-is-a-go-web-framework-from-5-0-0-until-5-4-1-echo-v5-s"},{"cve":"CVE-2026-118262","epss":0.003,"slug":"cve-2026-118262-echo-is-a-go-web-framework-from-4-15-0-until-4-16-1-and-5-4-1","title":"Echo Proxy middleware resource retention and DoS","severity":"info","exploited":false,"published_at":"2026-10-28T19:17:30.95+00:00","url":"https://junglewise.ai/threats/cve-2026-118262-echo-is-a-go-web-framework-from-4-15-0-until-4-16-1-and-5-4-1"},{"cvss":5.3,"slug":"echo-x-real-ip-extractor-trusts-the-header-value-instead-of-the-sending-e51c0fbe","title":"Echo X-Real-IP header spoofing vulnerability","severity":"medium","exploited":false,"published_at":"2026-10-23T20:50:25+00:00","url":"https://junglewise.ai/threats/echo-x-real-ip-extractor-trusts-the-header-value-instead-of-the-sending-e51c0fbe"},{"cvss":4,"slug":"echo-websocket-proxy-can-retain-connections-and-handlers-after-client-5418048e","title":"Echo WebSocket proxy resource retention after client disconnect","severity":"high","exploited":false,"published_at":"2026-10-23T20:50:17+00:00","url":"https://junglewise.ai/threats/echo-websocket-proxy-can-retain-connections-and-handlers-after-client-5418048e"},{"cvss":4,"slug":"echo-rejected-websocket-upgrades-can-bypass-echo-route-level-access-e87356e1","title":"Echo WebSocket upgrade authorization bypass","severity":"critical","exploited":false,"published_at":"2026-10-23T20:49:37+00:00","url":"https://junglewise.ai/threats/echo-rejected-websocket-upgrades-can-bypass-echo-route-level-access-e87356e1"},{"cvss":4,"slug":"echo-bodydump-can-discard-bodylimit-overflow-errors-for-unknown-length-077ea6f0","title":"Echo BodyDump middleware body limit bypass","severity":"medium","exploited":false,"published_at":"2026-10-23T20:49:11+00:00","url":"https://junglewise.ai/threats/echo-bodydump-can-discard-bodylimit-overflow-errors-for-unknown-length-077ea6f0"},{"cve":"CVE-2026-55677","cvss":7.5,"epss":0.0043,"slug":"cve-2026-55677-labstack-echo-authorization-bypass-in-static-file-handler","title":"Labstack Echo authorization bypass in static file handler","severity":"high","exploited":false,"published_at":"2026-06-26T17:16:34.203+00:00","url":"https://junglewise.ai/threats/cve-2026-55677-labstack-echo-authorization-bypass-in-static-file-handler"},{"cve":"CVE-2026-25766","cvss":3.1,"epss":0.0045,"slug":"cve-2026-25766-echo-has-a-windows-path-traversal-via-backslash-in-middleware","title":"Echo has a Windows path traversal via backslash in middleware.Static default filesystem","severity":"low","exploited":false,"published_at":"2026-02-26T16:27:48+00:00","url":"https://junglewise.ai/threats/cve-2026-25766-echo-has-a-windows-path-traversal-via-backslash-in-middleware"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":1,"exploited":0,"vulnerabilities":4},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":14},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"github.com/mattermost/mattermost-server (Go)","slug":"github-com-mattermost-mattermost-server","vulnerabilities":297,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server"},{"name":"github.com/mattermost/mattermost-server/v6 (Go)","slug":"github-com-mattermost-mattermost-server-v6","vulnerabilities":222,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6"},{"name":"github.com/mattermost/mattermost/server/v8 (Go)","slug":"github-com-mattermost-mattermost-server-v8","vulnerabilities":207,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8"},{"name":"github.com/mattermost/mattermost-server/v5 (Go)","slug":"github-com-mattermost-mattermost-server-v5","vulnerabilities":199,"url":"https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5"},{"name":"stdlib (Go)","slug":"go-stdlib","vulnerabilities":178,"url":"https://junglewise.ai/threats/technologies/go-stdlib"},{"name":"github.com/siyuan-note/siyuan/kernel (Go)","slug":"github-com-siyuan-note-siyuan-kernel","vulnerabilities":160,"url":"https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel"},{"name":"code.gitea.io/gitea (Go)","slug":"code-gitea-io-gitea","vulnerabilities":126,"url":"https://junglewise.ai/threats/technologies/code-gitea-io-gitea"},{"name":"code.vikunja.io/api (Go)","slug":"code-vikunja-io-api","vulnerabilities":91,"url":"https://junglewise.ai/threats/technologies/code-vikunja-io-api"},{"name":"gogs.io/gogs (Go)","slug":"gogs-io-gogs","vulnerabilities":81,"url":"https://junglewise.ai/threats/technologies/gogs-io-gogs"},{"name":"github.com/traefik/traefik/v2 (Go)","slug":"github-com-traefik-traefik-v2","vulnerabilities":78,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2"},{"name":"github.com/traefik/traefik (Go)","slug":"github-com-traefik-traefik","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-traefik-traefik"},{"name":"github.com/usememos/memos (Go)","slug":"github-com-usememos-memos","vulnerabilities":75,"url":"https://junglewise.ai/threats/technologies/github-com-usememos-memos"}],"technology":{"hub":true,"name":"github.com/labstack/echo/v5 (Go)","slug":"github-com-labstack-echo-v5","vendor":{"hub":true,"name":"Go","slug":"go","url":"https://junglewise.ai/threats/vendors/go"},"aliases":[],"repo_url":"https://github.com/labstack/echo","description":"Go web framework providing HTTP request routing, middleware, and response handling (v5).","url":"https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5"},"most_severe":[{"cvss":4,"slug":"echo-rejected-websocket-upgrades-can-bypass-echo-route-level-access-e87356e1","title":"Echo WebSocket upgrade authorization bypass","severity":"critical","exploited":false,"published_at":"2026-10-23T20:49:37+00:00","url":"https://junglewise.ai/threats/echo-rejected-websocket-upgrades-can-bypass-echo-route-level-access-e87356e1"},{"cve":"CVE-2026-55677","cvss":7.5,"epss":0.0043,"slug":"cve-2026-55677-labstack-echo-authorization-bypass-in-static-file-handler","title":"Labstack Echo authorization bypass in static file handler","severity":"high","exploited":false,"published_at":"2026-06-26T17:16:34.203+00:00","url":"https://junglewise.ai/threats/cve-2026-55677-labstack-echo-authorization-bypass-in-static-file-handler"},{"cve":"CVE-2026-118650","cvss":7.5,"epss":0.004,"slug":"cve-2026-118650-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-a-globally","title":"Echo path traversal via encoded static file requests","severity":"high","exploited":false,"published_at":"2026-10-28T20:17:21.85+00:00","url":"https://junglewise.ai/threats/cve-2026-118650-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-a-globally"},{"cvss":4,"slug":"echo-websocket-proxy-can-retain-connections-and-handlers-after-client-5418048e","title":"Echo WebSocket proxy resource retention after client disconnect","severity":"high","exploited":false,"published_at":"2026-10-23T20:50:17+00:00","url":"https://junglewise.ai/threats/echo-websocket-proxy-can-retain-connections-and-handlers-after-client-5418048e"},{"cve":"CVE-2026-118652","cvss":6.1,"epss":0.0024,"slug":"cve-2026-118652-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context","title":"Echo JSONP callback code injection","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.25+00:00","url":"https://junglewise.ai/threats/cve-2026-118652-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context"},{"cve":"CVE-2026-118656","cvss":6.1,"epss":0.002,"slug":"cve-2026-118656-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-sanitizeuri","title":"Echo open redirect in sanitizeURI with trailing slash redirect","severity":"medium","exploited":false,"published_at":"2026-10-28T21:16:55.55+00:00","url":"https://junglewise.ai/threats/cve-2026-118656-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-sanitizeuri"},{"cve":"CVE-2026-118654","cvss":5.9,"epss":0.0035,"slug":"cve-2026-118654-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s","title":"Echo path traversal in static file handlers via dot segment normalization","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.55+00:00","url":"https://junglewise.ai/threats/cve-2026-118654-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s"},{"cve":"CVE-2026-118655","cvss":5.9,"epss":0.003,"slug":"cve-2026-118655-echo-is-a-go-web-framework-prior-to-4-15-3-and-5-2-0-middleware","title":"Echo path traversal via double URL encoding in Static middleware","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.723+00:00","url":"https://junglewise.ai/threats/cve-2026-118655-echo-is-a-go-web-framework-prior-to-4-15-3-and-5-2-0-middleware"},{"cve":"CVE-2026-118657","cvss":5.9,"epss":0.0013,"slug":"cve-2026-118657-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context","title":"Echo Go web framework scheme header spoofing and HSTS bypass","severity":"medium","exploited":false,"published_at":"2026-10-28T21:16:55.693+00:00","url":"https://junglewise.ai/threats/cve-2026-118657-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context"},{"cve":"CVE-2026-118653","cvss":5.3,"epss":0.0042,"slug":"cve-2026-118653-echo-is-a-go-web-framework-from-4-0-0-until-5-1-0-context-realip","title":"Echo Go web framework rate-limit bypass via spoofed IP headers","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.4+00:00","url":"https://junglewise.ai/threats/cve-2026-118653-echo-is-a-go-web-framework-from-4-0-0-until-5-1-0-context-realip"}],"generated_at":"2026-11-13T03:07:00.155039+00:00"}