Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118656 · GHSA-v753-g4cw-jm48

Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI

Risk score
47/100
CVSS
6.1 v3.1
Published
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade …
Affected
github.com/labstack/echo/v5 (go) < 5.4.0; github.com/labstack/echo/v4 (go) < 4.16.0
Fix
Upgrade github.com/labstack/echo/v5 to 5.4.0; github.com/labstack/echo/v4 to 4.16.0 or later.
Exploitation
Public proof of concept

Story map

Story map: github.com/labstack/echo/v5THE FLAWSTHE FIXCVE-2026-118656Echo has Open Redirect viaControl-Character PrefixDefeating sanitizeURICVSS 6.1CVE-2026-118650Echo's middleware.Static:`%2F`-encoded path bypassesroute/group middleware…CVSS 7.5CVE-2026-118657Echo: HTTPS Redirect and HSTSBypass via Unconditional Trustof Forwarded Scheme HeadersCVSS 5.9CVE-2026-118654Echo static file middlewareroute protection bypass viaencoded dot-dot traversalCVSS 5.9Upgrade…4.16.0 · 5.4.0or later on your release lineWho is exposedgithub.com/labstack/echo/v5(go) < 5.4.0;github.com/labstack/echo/v4(go) < 4.16.0YELLOW · PLAN IT INgithub.com/labstack/echo/v5Echo is a Go web framework.Prior to 4.16.0 and 5.4.0, aglobally mountedmiddleware.Static instance caninterpret an encoded requestpath differently from Echo'srouter because the router…Where it standsPublic proof of conceptCONNECTS TOSame weaknessOpen redirect (CWE-601)28 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/labstack/echo/v5: Yellow, plan it in. Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash reso…

The flaws

  • CVE-2026-118656: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI (CVSS 6.1)
  • CVE-2026-118650: Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path (CVSS 7.5)
  • CVE-2026-118657: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers (CVSS 5.9)
  • CVE-2026-118654: Echo static file middleware route protection bypass via encoded dot-dot traversal (CVSS 5.9)

The fix

Upgrade github.com/labstack/echo/v5: 4.16.0 · 5.4.0 or later on your release line

Who is exposed: github.com/labstack/echo/v5 (go) < 5.4.0; github.com/labstack/echo/v4 (go) < 4.16.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.1 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: Go

Affected packages

PackageEcosystemVulnerableFixed in
github.com/labstack/echo/v5go< 5.4.05.4.0
github.com/labstack/echo/v4go< 4.16.04.16.0

References

Original description

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.