[Git][security-tracker-team/security-tracker][master] Track new CVEs for Echo web framework

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
1f55fea0 by Salvatore Bonaccorso at 2026-10-29T09:16:10+01:00
Track new CVEs for Echo web framework

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -176,23 +176,51 @@ CVE-2026-118660 (Happy DOM is a JavaScript implementation of a web browser witho
 CVE-2026-118659 (Happy DOM is a JavaScript implementation of a web browser without its  ...)
 	TODO: check
 CVE-2026-118658 (Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme  ...)
-	TODO: check
+	- golang-github-labstack-echo <unfixed>
+	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181 (v4.15.2)
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df (v5.1.1)
 CVE-2026-118657 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme  ...)
-	TODO: check
+	- golang-github-labstack-echo <unfixed>
+	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118656 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...)
-	TODO: check
+	- golang-github-labstack-echo <unfixed>
+	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118655 (Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Stat ...)
-	TODO: check
+	- golang-github-labstack-echo <unfixed>
+	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96
+	NOTE: https://github.com/labstack/echo/issues/2599
+	NOTE: https://github.com/labstack/echo/pull/3006
+	NOTE: Fixed by; https://github.com/labstack/echo/commit/c3fa2a27ff92b2b8db360de614f999ef1da24725 (v4.15.3)
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6 (v5.2.0)
 CVE-2026-118654 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...)
-	TODO: check
+	- golang-github-labstack-echo <unfixed>
+	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118653 (Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...)
-	TODO: check
+	- golang-github-labstack-echo <unfixed>
+	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2 (v5.1.0)
 CVE-2026-118652 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...)
-	TODO: check
+	- golang-github-labstack-echo <unfixed>
+	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118651 (Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...)
-	TODO: check
+	- golang-github-labstack-echo <unfixed>
+	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118650 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally moun ...)
-	TODO: check
+	- golang-github-labstack-echo <not-affected> (Incomplete fix for CVE-2026-55677 not applied)
+	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-375p-5qhx-8wq4
+	NOTE: Issue exists because of an incomplete fix for CVE-2026-55677
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118590 (A security vulnerability has been detected in nipy nibabel up to 5.4.2 ...)
 	TODO: check
 CVE-2026-118589 (A weakness has been identified in nschloe meshio up to 5.3.5. Impacted ...)
@@ -214,7 +242,10 @@ CVE-2026-118537 (A vulnerability was found in a2ui up to 0.10.4. This vulnerabil
 CVE-2026-118426 (In affected versions of Octopus Server with the LDAP authentication pr ...)
 	NOT-FOR-US: Octopus Deploy
 CVE-2026-118266 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's MethodOv ...)
-	TODO: check
+	- golang-github-labstack-echo <unfixed>
+	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-r7w9-592q-9vg4
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
+	NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
 CVE-2026-118030 (A flaw was found in the HOTP authentication mechanism of the keycloak- ...)
 	TODO: check
 CVE-2026-117859 (A flaw was found in the Pushed Authorization Request PAR implementatio ...)
@@ -154033,6 +154064,7 @@ CVE-2026-55677 (Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's ro
 	- golang-github-labstack-echo.v2 <removed>
 	[bullseye] - golang-github-labstack-echo.v2 <not-affected> (static handler does no url.PathUnescape; encoded-separator path absent)
 	NOTE: https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq
+	NOTE: When fixing this issue make sure to not open up CVE-2026-118650
 CVE-2026-55448 (mise manages dev tools like node, python, cmake, and terraform. From 2 ...)
 	NOT-FOR-US: mise
 CVE-2026-55441 (mise manages dev tools like node, python, cmake, and terraform. Prior  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1f55fea0dd8eaff3a217f0ed22e4794035a019ec

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1f55fea0dd8eaff3a217f0ed22e4794035a019ec
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261029/e0231119/attachment-0001.htm>