Vulnerability GO-2026-6878
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
9 hours ago
November 05, 2026 at 10:54 PM UTC
Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo
<4.15.2
<4.15.2
Summary
Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo
Details
Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
9 hours ago
Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo
>=4.0.0 GO-2026-6872
>=4.0.0 GO-2026-6872
Unknown
9 hours ago
Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo
<5.1.0 GO-2026-6872
<5.1.0 GO-2026-6872
Unknown
9 hours ago
URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo
<4.16.0 GO-2026-6873
<4.16.0 GO-2026-6873
Unknown
9 hours ago
URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo
>=5.0.0 <5.4.0 GO-2026-6873
>=5.0.0 <5.4.0 GO-2026-6873
Unknown
9 hours ago
Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo
>=4.0.0 GO-2026-6875
>=4.0.0 GO-2026-6875
Impacted packages
Timeline
Published
9 hours ago
November 05, 2026 at 10:54 PM UTC
Fixed (v4.15.2)
6 months ago
May 01, 2026 at 05:59 PM UTC
Fixed (v5.1.1)
6 months ago
May 01, 2026 at 07:14 PM UTC
Last Modified
8 hours ago
November 05, 2026 at 11:15 PM UTC