Labstack Echo Open Redirect vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-40083 · ADVISORY
• labstack/echo · WEB
• labstack/echo#2260 · WEB
• labstack/echo#2260 · WEB
• labstack/echo commit 0ac4d74 · WEB
• labstack/echo · PACKAGE
• labstack/echo release v4.9.0 · WEB
• pkg.go.dev/vuln/GO-2022-1031 · WEB

Mais vulnerabilidades de github.com/labstack/echo/v4

• CVE-2026-118658MÉDIO 4.7Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-…
• CVE-2026-118657MÉDIO 5.9Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A cli…
• CVE-2026-118656MÉDIO 6.1Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whet…
• CVE-2026-118655MÉDIO 5.9Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Doubl…
• CVE-2026-118654MÉDIO 5.9Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve…