github.com/labstack/echo/v5

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Critical 9.1

CVE-2026-118264

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an…

labstack echo golang-github-labstack-echo golang-github-labstack-echo.v2 Debian Ubuntu Go

Oct 28, 2026