Labstack vulnerabilities
We track 7 vulnerabilities in Labstack products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest Labstack vulnerabilities
- 7.5 High severity
echo: Improper Handling of URL Encoding (Hex Encoding)
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decode
- 9.1 Critical severity
echo: Inconsistent Interpretation of HTTP Requests
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an
- 8.2 High severity
echo: Missing Release of Resource after Effective Lifetime
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for bot
- 8.2 High severity
echo: Uncontrolled Resource Consumption
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it,
- 8.2 High severity
echo: Uncontrolled Resource Consumption
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client
- 7.5 High severity
echo: Improper Limitation of a Pathname to a Restricted Directory
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before reso
- 9.6 Critical severity
Echo: URL Redirection to Untrusted Site
Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF).