Security releases
Researcher credits in vendor advisories
Vendors name researchers in their own advisories. Find your line and claim it. It counts on your profile right away and gets a BugRater ID you can quote.
Vendor
-
Labstack CVE-2026-118658
Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without valid
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118657
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Ech
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118656
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with a
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118655
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118654
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a pu
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118653
Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is un
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118652
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated callback value into a JavaScript response.
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118651
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream servic
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118650
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118266
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOverride middleware accepts a safe HTTP method as the override target for a POST request. Wh
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118265
Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's ExtractIPFromRealIPHeader validates whether the client-supplied X-Real-IP value belongs to a trust
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118264
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verif
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118263
Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when Body
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118262
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a W
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118261
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded
0 CVEs and 0 credit lines.
-
Labstack CVE-2026-118260
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and reta
0 CVEs and 0 credit lines.