Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.9
CVE-2026-118657: Echo framework can be tricked into skipping HTTPS redirects
CVE-2026-118657 · published 7 days ago
Summary
The Echo web framework treats certain headers that indicate the connection is secure without checking who sent them. An attacker who can send a request directly over plain HTTP, or control the headers passed through a proxy, can make the application think the request is already using HTTPS, allowing it to bypass forced HTTPS redirects and suppress security headers. Update Echo to version 4.16.0 or later (or 5.4.0 or later) to fix the issue.
What to do
- Update github.com labstack to version 5.4.0.
- Update github.com labstack to version 4.16.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | labstack | echo | >= 5.0.0, < 5.4.0 |
| go | github.com | labstack |
< 5.4.0 Fix: upgrade to 5.4.0
|
| go | github.com | labstack |
< 4.16.0 Fix: upgrade to 4.16.0
|
| Debian:12 | debian | golang-github-labstack-echo | All versions |
Original advisory text
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0.
References
- https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 Patch
- https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af Patch
- https://github.com/labstack/echo/releases/tag/v4.16.0 URL
- https://github.com/labstack/echo/releases/tag/v5.4.0 URL
- https://github.com/advisories/GHSA-2ffq-g2xg-c22p
- https://security-tracker.debian.org/tracker/CVE-2026-118657 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-1186... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-118657 Vendor Advisory
- https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-346Origin Validation Error
Timeline
Published28 Oct 2026
Updated4 Nov 2026
First seen28 Oct 2026
Sources
CVE-2026-118657 · NVD
CVE-2026-118657 · MITRE
GHSA-2ffq-g2xg-c22p · GHSA
DEBIAN-CVE-2026-118657 · OSV
CVE-2026-118657 · OSV
Track software like this
Free during beta