Technology · Labstack
Labstack Echo vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 22 vulnerabilities in Labstack Echo: 0 in the last 7 days and 22 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-118658, was published on 28 October 2026. 22 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0.
- Last 7 days
- 0
- Last 90 days
- 22
- Critical, all time
- 1
- Exploited in the wild
- 0
About Labstack Echo
Go web framework for building HTTP applications and REST APIs.
Latest Labstack Echo vulnerabilities
- CVE-2026-118658: Echo web framework arbitrary URI scheme redirectmediumCVSS 4.7EPSS 0.2%
- CVE-2026-118657: Echo Go web framework scheme header spoofing and HSTS bypassmediumCVSS 5.9EPSS 0.1%
- CVE-2026-118656: Echo open redirect in sanitizeURI with trailing slash redirectmediumCVSS 6.1EPSS 0.2%
- CVE-2026-118655: Echo path traversal via double URL encoding in Static middlewaremediumCVSS 5.9EPSS 0.3%
- CVE-2026-118654: Echo path traversal in static file handlers via dot segment normalizationmediumCVSS 5.9EPSS 0.4%
- CVE-2026-118653: Echo Go web framework rate-limit bypass via spoofed IP headersmediumCVSS 5.3EPSS 0.4%
- CVE-2026-118652: Echo JSONP callback code injectionmediumCVSS 6.1EPSS 0.2%
- CVE-2026-118651: Echo Proxy middleware IP spoofing via X-Real-IP headermediumCVSS 5.3EPSS 0.2%
- CVE-2026-118650: Echo path traversal via encoded static file requestshighCVSS 7.5EPSS 0.4%
- CVE-2026-118266: Echo MethodOverride middleware CSRF bypassmediumCVSS 5.3EPSS 0.2%
- CVE-2026-118265: Echo X-Real-IP header spoofing via untrusted extractormediumCVSS 5.3EPSS 0.1%
- CVE-2026-118264: Echo Proxy middleware WebSocket upgrade validation bypassinfoEPSS 0.4%
- CVE-2026-118263: Echo BodyDump middleware body limit bypassinfoEPSS 0.4%
- CVE-2026-118262: Echo Proxy middleware resource retention and DoSinfoEPSS 0.3%
- CVE-2026-118261: Echo Decompress middleware denial of serviceinfoEPSS 0.4%
- CVE-2026-118260: Echo BodyDump middleware unbounded memory allocationinfoEPSS 0.4%
- Echo X-Real-IP header spoofing vulnerabilitymediumCVSS 5.3
- Echo WebSocket proxy resource retention after client disconnecthighCVSS 4
- Echo Decompress unbounded gzip expansionhighCVSS 4
- Echo WebSocket upgrade authorization bypasscriticalCVSS 4
- Echo BodyDump middleware body limit bypassmediumCVSS 4
- Echo BodyDump unbounded memory allocation denial of servicehighCVSS 4
Most severe Labstack Echo vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- Echo WebSocket upgrade authorization bypasscriticalCVSS 4
- CVE-2026-118650: Echo path traversal via encoded static file requestshighCVSS 7.5EPSS 0.4%
- Echo WebSocket proxy resource retention after client disconnecthighCVSS 4
- Echo Decompress unbounded gzip expansionhighCVSS 4
- Echo BodyDump unbounded memory allocation denial of servicehighCVSS 4
- CVE-2026-118652: Echo JSONP callback code injectionmediumCVSS 6.1EPSS 0.2%
- CVE-2026-118656: Echo open redirect in sanitizeURI with trailing slash redirectmediumCVSS 6.1EPSS 0.2%
- CVE-2026-118654: Echo path traversal in static file handlers via dot segment normalizationmediumCVSS 5.9EPSS 0.4%
- CVE-2026-118655: Echo path traversal via double URL encoding in Static middlewaremediumCVSS 5.9EPSS 0.3%
- CVE-2026-118657: Echo Go web framework scheme header spoofing and HSTS bypassmediumCVSS 5.9EPSS 0.1%
Vulnerabilities per week
22 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 6 | 1 | |
| 26 Oct 2026 | 16 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Labstack Echo vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/labstack-echo)<a href="https://junglewise.ai/threats/technologies/labstack-echo"><img src="https://junglewise.ai/threats/technologies/labstack-echo/badge.svg" alt="Labstack Echo vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/labstack-echo.json, and this page as text at https://junglewise.ai/threats/technologies/labstack-echo.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Labstack Echo vulnerabilities", https://junglewise.ai/threats/technologies/labstack-echo, 9 November 2026.