Labstack Echo Open Redirect vulnerability

CRITICAL 9.6CVE-2022-40083 · GHSA-crxj-hrmp-4rwf · GO-2022-1031 · Published 28/09/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/labstack/echo/v4 Go	`< 4.9.0`	`4.9.0`
echo labstack	`= 4.8.0`	No fix yet

Description

Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF). Version 4.9.0 contains a patch for the issue.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-40083 · ADVISORY
labstack/echo · WEB
labstack/echo#2260 · WEB
labstack/echo#2260 · WEB
labstack/echo commit 0ac4d74 · WEB
labstack/echo · PACKAGE
labstack/echo release v4.9.0 · WEB
pkg.go.dev/vuln/GO-2022-1031 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free