{"schema_version":1,"title":"Labstack vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 23 vulnerabilities in Labstack: 0 in the last 7 days and 22 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-118658, was published on 28 October 2026. 22 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/labstack","json_url":"https://junglewise.ai/threats/vendors/labstack.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/labstack","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":5,"all_time":23,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":22,"last_90_days":22,"last_365_days":23},"latest":[{"cve":"CVE-2026-118658","cvss":4.7,"epss":0.0019,"slug":"cve-2026-118658-echo-is-a-go-web-framework-prior-to-4-15-2-and-5-1-1-context","title":"Echo web framework arbitrary URI scheme redirect","severity":"medium","exploited":false,"published_at":"2026-10-28T21:16:55.827+00:00","url":"https://junglewise.ai/threats/cve-2026-118658-echo-is-a-go-web-framework-prior-to-4-15-2-and-5-1-1-context"},{"cve":"CVE-2026-118657","cvss":5.9,"epss":0.0013,"slug":"cve-2026-118657-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context","title":"Echo Go web framework scheme header spoofing and HSTS bypass","severity":"medium","exploited":false,"published_at":"2026-10-28T21:16:55.693+00:00","url":"https://junglewise.ai/threats/cve-2026-118657-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context"},{"cve":"CVE-2026-118656","cvss":6.1,"epss":0.002,"slug":"cve-2026-118656-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-sanitizeuri","title":"Echo open redirect in sanitizeURI with trailing slash redirect","severity":"medium","exploited":false,"published_at":"2026-10-28T21:16:55.55+00:00","url":"https://junglewise.ai/threats/cve-2026-118656-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-sanitizeuri"},{"cve":"CVE-2026-118655","cvss":5.9,"epss":0.003,"slug":"cve-2026-118655-echo-is-a-go-web-framework-prior-to-4-15-3-and-5-2-0-middleware","title":"Echo path traversal via double URL encoding in Static middleware","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.723+00:00","url":"https://junglewise.ai/threats/cve-2026-118655-echo-is-a-go-web-framework-prior-to-4-15-3-and-5-2-0-middleware"},{"cve":"CVE-2026-118654","cvss":5.9,"epss":0.0035,"slug":"cve-2026-118654-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s","title":"Echo path traversal in static file handlers via dot segment normalization","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.55+00:00","url":"https://junglewise.ai/threats/cve-2026-118654-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s"},{"cve":"CVE-2026-118653","cvss":5.3,"epss":0.0042,"slug":"cve-2026-118653-echo-is-a-go-web-framework-from-4-0-0-until-5-1-0-context-realip","title":"Echo Go web framework rate-limit bypass via spoofed IP headers","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.4+00:00","url":"https://junglewise.ai/threats/cve-2026-118653-echo-is-a-go-web-framework-from-4-0-0-until-5-1-0-context-realip"},{"cve":"CVE-2026-118652","cvss":6.1,"epss":0.0024,"slug":"cve-2026-118652-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context","title":"Echo JSONP callback code injection","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.25+00:00","url":"https://junglewise.ai/threats/cve-2026-118652-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context"},{"cve":"CVE-2026-118651","cvss":5.3,"epss":0.0021,"slug":"cve-2026-118651-echo-is-a-go-web-framework-from-4-0-0-until-5-4-0-the-proxy","title":"Echo Proxy middleware IP spoofing via X-Real-IP header","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.073+00:00","url":"https://junglewise.ai/threats/cve-2026-118651-echo-is-a-go-web-framework-from-4-0-0-until-5-4-0-the-proxy"},{"cve":"CVE-2026-118650","cvss":7.5,"epss":0.004,"slug":"cve-2026-118650-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-a-globally","title":"Echo path traversal via encoded static file requests","severity":"high","exploited":false,"published_at":"2026-10-28T20:17:21.85+00:00","url":"https://junglewise.ai/threats/cve-2026-118650-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-a-globally"},{"cve":"CVE-2026-118266","cvss":5.3,"epss":0.0016,"slug":"cve-2026-118266-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s","title":"Echo MethodOverride middleware CSRF bypass","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:21.577+00:00","url":"https://junglewise.ai/threats/cve-2026-118266-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s"},{"cve":"CVE-2026-118265","cvss":5.3,"epss":0.0014,"slug":"cve-2026-118265-echo-is-a-go-web-framework-from-5-0-0-until-5-4-1-echo-v5-s","title":"Echo X-Real-IP header spoofing via untrusted extractor","severity":"medium","exploited":false,"published_at":"2026-10-28T19:17:31.377+00:00","url":"https://junglewise.ai/threats/cve-2026-118265-echo-is-a-go-web-framework-from-5-0-0-until-5-4-1-echo-v5-s"},{"cve":"CVE-2026-118264","epss":0.0043,"slug":"cve-2026-118264-echo-is-a-go-web-framework-from-4-0-0-until-4-16-1-and-5-4-1","title":"Echo Proxy middleware WebSocket upgrade validation bypass","severity":"info","exploited":false,"published_at":"2026-10-28T19:17:31.237+00:00","url":"https://junglewise.ai/threats/cve-2026-118264-echo-is-a-go-web-framework-from-4-0-0-until-4-16-1-and-5-4-1"},{"cve":"CVE-2026-118263","epss":0.0039,"slug":"cve-2026-118263-echo-is-a-go-web-framework-from-5-0-0-until-5-4-1-echo-v5-s","title":"Echo BodyDump middleware body limit bypass","severity":"info","exploited":false,"published_at":"2026-10-28T19:17:31.097+00:00","url":"https://junglewise.ai/threats/cve-2026-118263-echo-is-a-go-web-framework-from-5-0-0-until-5-4-1-echo-v5-s"},{"cve":"CVE-2026-118262","epss":0.003,"slug":"cve-2026-118262-echo-is-a-go-web-framework-from-4-15-0-until-4-16-1-and-5-4-1","title":"Echo Proxy middleware resource retention and DoS","severity":"info","exploited":false,"published_at":"2026-10-28T19:17:30.95+00:00","url":"https://junglewise.ai/threats/cve-2026-118262-echo-is-a-go-web-framework-from-4-15-0-until-4-16-1-and-5-4-1"},{"cve":"CVE-2026-118261","epss":0.0037,"slug":"cve-2026-118261-echo-is-a-go-web-framework-from-4-0-0-until-4-16-1-echo-v4-s-opt","title":"Echo Decompress middleware denial of service","severity":"info","exploited":false,"published_at":"2026-10-28T19:17:30.81+00:00","url":"https://junglewise.ai/threats/cve-2026-118261-echo-is-a-go-web-framework-from-4-0-0-until-4-16-1-echo-v4-s-opt"},{"cve":"CVE-2026-118260","epss":0.0037,"slug":"cve-2026-118260-echo-is-a-go-web-framework-from-4-0-0-until-4-16-1-echo-v4-s-opt","title":"Echo BodyDump middleware unbounded memory allocation","severity":"info","exploited":false,"published_at":"2026-10-28T19:17:30.663+00:00","url":"https://junglewise.ai/threats/cve-2026-118260-echo-is-a-go-web-framework-from-4-0-0-until-4-16-1-echo-v4-s-opt"},{"cvss":5.3,"slug":"echo-x-real-ip-extractor-trusts-the-header-value-instead-of-the-sending-e51c0fbe","title":"Echo X-Real-IP header spoofing vulnerability","severity":"medium","exploited":false,"published_at":"2026-10-23T20:50:25+00:00","url":"https://junglewise.ai/threats/echo-x-real-ip-extractor-trusts-the-header-value-instead-of-the-sending-e51c0fbe"},{"cvss":4,"slug":"echo-websocket-proxy-can-retain-connections-and-handlers-after-client-5418048e","title":"Echo WebSocket proxy resource retention after client disconnect","severity":"high","exploited":false,"published_at":"2026-10-23T20:50:17+00:00","url":"https://junglewise.ai/threats/echo-websocket-proxy-can-retain-connections-and-handlers-after-client-5418048e"},{"cvss":4,"slug":"echo-decompress-permits-unbounded-gzip-expansion-in-v4-4854c33a","title":"Echo Decompress unbounded gzip expansion","severity":"high","exploited":false,"published_at":"2026-10-23T20:49:49+00:00","url":"https://junglewise.ai/threats/echo-decompress-permits-unbounded-gzip-expansion-in-v4-4854c33a"},{"cvss":4,"slug":"echo-rejected-websocket-upgrades-can-bypass-echo-route-level-access-e87356e1","title":"Echo WebSocket upgrade authorization bypass","severity":"critical","exploited":false,"published_at":"2026-10-23T20:49:37+00:00","url":"https://junglewise.ai/threats/echo-rejected-websocket-upgrades-can-bypass-echo-route-level-access-e87356e1"},{"cvss":4,"slug":"echo-bodydump-can-discard-bodylimit-overflow-errors-for-unknown-length-077ea6f0","title":"Echo BodyDump middleware body limit bypass","severity":"medium","exploited":false,"published_at":"2026-10-23T20:49:11+00:00","url":"https://junglewise.ai/threats/echo-bodydump-can-discard-bodylimit-overflow-errors-for-unknown-length-077ea6f0"},{"cvss":4,"slug":"echo-bodydump-captures-request-and-response-bodies-without-size-limits-2c3412a3","title":"Echo BodyDump unbounded memory allocation denial of service","severity":"high","exploited":false,"published_at":"2026-10-23T20:48:44+00:00","url":"https://junglewise.ai/threats/echo-bodydump-captures-request-and-response-bodies-without-size-limits-2c3412a3"},{"cve":"CVE-2026-55677","cvss":7.5,"epss":0.0043,"slug":"cve-2026-55677-labstack-echo-authorization-bypass-in-static-file-handler","title":"Labstack Echo authorization bypass in static file handler","severity":"high","exploited":false,"published_at":"2026-06-26T17:16:34.203+00:00","url":"https://junglewise.ai/threats/cve-2026-55677-labstack-echo-authorization-bypass-in-static-file-handler"}],"vendor":{"hub":true,"name":"Labstack","slug":"labstack","description":"Open source software organization that develops web frameworks and tooling.","url":"https://junglewise.ai/threats/vendors/labstack"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":1,"exploited":0,"vulnerabilities":6},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":16},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cvss":4,"slug":"echo-rejected-websocket-upgrades-can-bypass-echo-route-level-access-e87356e1","title":"Echo WebSocket upgrade authorization bypass","severity":"critical","exploited":false,"published_at":"2026-10-23T20:49:37+00:00","url":"https://junglewise.ai/threats/echo-rejected-websocket-upgrades-can-bypass-echo-route-level-access-e87356e1"},{"cve":"CVE-2026-55677","cvss":7.5,"epss":0.0043,"slug":"cve-2026-55677-labstack-echo-authorization-bypass-in-static-file-handler","title":"Labstack Echo authorization bypass in static file handler","severity":"high","exploited":false,"published_at":"2026-06-26T17:16:34.203+00:00","url":"https://junglewise.ai/threats/cve-2026-55677-labstack-echo-authorization-bypass-in-static-file-handler"},{"cve":"CVE-2026-118650","cvss":7.5,"epss":0.004,"slug":"cve-2026-118650-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-a-globally","title":"Echo path traversal via encoded static file requests","severity":"high","exploited":false,"published_at":"2026-10-28T20:17:21.85+00:00","url":"https://junglewise.ai/threats/cve-2026-118650-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-a-globally"},{"cvss":4,"slug":"echo-websocket-proxy-can-retain-connections-and-handlers-after-client-5418048e","title":"Echo WebSocket proxy resource retention after client disconnect","severity":"high","exploited":false,"published_at":"2026-10-23T20:50:17+00:00","url":"https://junglewise.ai/threats/echo-websocket-proxy-can-retain-connections-and-handlers-after-client-5418048e"},{"cvss":4,"slug":"echo-decompress-permits-unbounded-gzip-expansion-in-v4-4854c33a","title":"Echo Decompress unbounded gzip expansion","severity":"high","exploited":false,"published_at":"2026-10-23T20:49:49+00:00","url":"https://junglewise.ai/threats/echo-decompress-permits-unbounded-gzip-expansion-in-v4-4854c33a"},{"cvss":4,"slug":"echo-bodydump-captures-request-and-response-bodies-without-size-limits-2c3412a3","title":"Echo BodyDump unbounded memory allocation denial of service","severity":"high","exploited":false,"published_at":"2026-10-23T20:48:44+00:00","url":"https://junglewise.ai/threats/echo-bodydump-captures-request-and-response-bodies-without-size-limits-2c3412a3"},{"cve":"CVE-2026-118652","cvss":6.1,"epss":0.0024,"slug":"cve-2026-118652-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context","title":"Echo JSONP callback code injection","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.25+00:00","url":"https://junglewise.ai/threats/cve-2026-118652-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context"},{"cve":"CVE-2026-118656","cvss":6.1,"epss":0.002,"slug":"cve-2026-118656-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-sanitizeuri","title":"Echo open redirect in sanitizeURI with trailing slash redirect","severity":"medium","exploited":false,"published_at":"2026-10-28T21:16:55.55+00:00","url":"https://junglewise.ai/threats/cve-2026-118656-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-sanitizeuri"},{"cve":"CVE-2026-118654","cvss":5.9,"epss":0.0035,"slug":"cve-2026-118654-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s","title":"Echo path traversal in static file handlers via dot segment normalization","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.55+00:00","url":"https://junglewise.ai/threats/cve-2026-118654-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s"},{"cve":"CVE-2026-118655","cvss":5.9,"epss":0.003,"slug":"cve-2026-118655-echo-is-a-go-web-framework-prior-to-4-15-3-and-5-2-0-middleware","title":"Echo path traversal via double URL encoding in Static middleware","severity":"medium","exploited":false,"published_at":"2026-10-28T20:17:22.723+00:00","url":"https://junglewise.ai/threats/cve-2026-118655-echo-is-a-go-web-framework-prior-to-4-15-3-and-5-2-0-middleware"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[{"name":"Labstack Echo","slug":"labstack-echo","vulnerabilities":22,"url":"https://junglewise.ai/threats/technologies/labstack-echo"}]}