pathutil

  GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo

  GO-2026-6839: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo

  GO-2026-6841: Echo: X-Real-IP extractor trusts the header value instead of the sending peer in github.com/labstack/echo

  GO-2026-6844: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests in github.com/labstack/echo

  GO-2026-6873: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo

  GO-2026-6875: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo

  GO-2026-6876: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo

  GO-2026-6877: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo

  GO-2026-6879: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

  GO-2026-6881: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo

  GO-2026-6883: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo