CVE-2026-118657 · GHSA-2ffq-g2xg-c22p

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Risk score: 45/100
CVSS: 5.9 v3.1
Published: 28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-te…
Affected: github.com/labstack/echo/v5 (go) < 5.4.0; github.com/labstack/echo/v4 (go) < 4.16.0
Fix: Upgrade github.com/labstack/echo/v5 to 5.4.0; github.com/labstack/echo/v4 to 4.16.0 or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/labstack/echo/v5: Yellow, plan it in. Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally mounted middleware.Static instance can interpret an encoded request path differently from Echo's router because the router matches the still-encoded path while the static handler uses the decoded URL.Path. The advisory demonstrates an encoded slash reso…

The flaws

CVE-2026-118657: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers (CVSS 5.9)
CVE-2026-118650: Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path (CVSS 7.5)
CVE-2026-118656: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI (CVSS 6.1)
CVE-2026-118654: Echo static file middleware route protection bypass via encoded dot-dot traversal (CVSS 5.9)

The fix

Upgrade github.com/labstack/echo/v5: 4.16.0 · 5.4.0 or later on your release line

Who is exposed: github.com/labstack/echo/v5 (go) < 5.4.0; github.com/labstack/echo/v4 (go) < 4.16.0

Where it stands

Public proof of concept

Connects to

Same weakness: CWE-346 (CWE-346). 62 other warnings in 30 days

Why it is Yellow

CVSS 5.9 medium
Public exploit or proof of concept referenced
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/labstack/echo/v5	go	< 5.4.0	5.4.0
github.com/labstack/echo/v4	go	< 4.16.0	4.16.0

References

Original description

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.