labstack has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 6. The median CVSS is 5.3 (medium), with 1 rated critical. None have a confirmed exploitation report. Most affected products: github.com/labstack/echo/v4 (4), github.com/labstack/echo/v5 (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Products
- github.com/labstack/echo/v4 4
- github.com/labstack/echo/v5 2
Worst active — by depth score
GHSA-cxf3-9h37-7rr8CriticalEcho: Rejected WebSocket upgrades can bypass Echo route-level access controls52GHSA-h7wr-284f-5qvcHighEcho: Decompress permits unbounded gzip expansion in v441GHSA-f48p-c9v4-h7xvHighEcho: BodyDump captures request and response bodies without size limits in v441GHSA-9969-6676-49h5HighEcho: WebSocket proxy can retain connections and handlers after client disconnect41GHSA-h53f-rm2w-w7rgMedium· 5.3Echo: X-Real-IP extractor trusts the header value instead of the sending peer29
labstack vulnerabilities
CVEs affecting labstack, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
GHSA-x9ff-22gv-65f4MediumEcho: BodyDump can discard BodyLimit overflow errors for unknown-length requests
Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
GHSA-f48p-c9v4-h7xvHighEcho: BodyDump captures request and response bodies without size limits in v4
Echo: BodyDump captures request and response bodies without size limits in v4
GHSA-h7wr-284f-5qvcHighEcho: Decompress permits unbounded gzip expansion in v4
Echo: Decompress permits unbounded gzip expansion in v4
GHSA-cxf3-9h37-7rr8CriticalEcho: Rejected WebSocket upgrades can bypass Echo route-level access controls
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
GHSA-h53f-rm2w-w7rgMedium· 5.3Echo: X-Real-IP extractor trusts the header value instead of the sending peer
Echo: X-Real-IP extractor trusts the header value instead of the sending peer
GHSA-9969-6676-49h5HighEcho: WebSocket proxy can retain connections and handlers after client disconnect
Echo: WebSocket proxy can retain connections and handlers after client disconnect