(Critical) Vulnerabilities in dependent libs

[svergin]

Hi all,
I'm using the latest version of echo and there are currently some some (critical) CVEs in dependent libs:
CVE-2025-22869 Critical
CVE-2025-22870 Medium
CVE-2025-22872 Medium

When will there be a new version of echo available, which fixes the security issues?

Regards, Sven

[aldas]

which libs? golang.org/x/...?

edit: that aquasec website is a mess to understand. These are better links

• https://pkg.go.dev/vuln/GO-2025-3487 (affects: golang.org/x/crypto/ssh)
• https://pkg.go.dev/vuln/GO-2025-3503 (affects: golang.org/x/net/http/httpproxy and golang.org/x/net/proxy )
• https://pkg.go.dev/vuln/GO-2025-3595 (affects: golang.org/x/net/html )

[aldas]

https://github.com/labstack/echo/releases/tag/v4.13.4 is released

[svergin]

Thank you for the quick reaction!