CVE-2026-118657
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0.
Fixes and workarounds
Fix
github.com/labstack/echo/v5 (Go): OSV reports a fixed version 5.4.0. Check the advisory for supported release branches.
Source: OSV GHSA-2ffq-g2xg-c22pFix
github.com/labstack/echo/v4 (Go): OSV reports a fixed version 4.16.0. Check the advisory for supported release branches.
Source: OSV GHSA-2ffq-g2xg-c22pAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| echo labstack |
>= 5.0.0, < 5.4.0 (affected) < 4.16.0 (affected) |
CNA: GitHub_M |
github.com/labstack/echo/v5github.com/labstack/echo/v5
Go |
≥ 0; < 5.4.0 (affected, semver); OSV events: introduced 0; fixed 5.4.0Source events (semver)Other versions: unaffected |
OSV GHSA-2ffq-g2xg-c22p |
github.com/labstack/echo/v4github.com/labstack/echo/v4
Go |
≥ 0; < 4.16.0 (affected, semver); OSV events: introduced 0; fixed 4.16.0Source events (semver)Other versions: unaffected |
OSV GHSA-2ffq-g2xg-c22p |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 5.9 medium |
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N | CNA: GitHub_M |
Exploit evidence
- https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p
exploit · ADP: CISA-ADP
References
- https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22pCNA: GitHub_M · x_refsource_CONFIRM
- https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1CNA: GitHub_M · x_refsource_MISC
- https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5afCNA: GitHub_M · x_refsource_MISC
- https://github.com/labstack/echo/releases/tag/v4.16.0CNA: GitHub_M · x_refsource_MISC
- https://github.com/labstack/echo/releases/tag/v5.4.0CNA: GitHub_M · x_refsource_MISC
- https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22pADP: CISA-ADP · exploit
- https://github.com/advisories/GHSA-2ffq-g2xg-c22pOSV / GitHub Security Advisories · advisory
- https://osv.dev/vulnerability/GHSA-2ffq-g2xg-c22pOSV / GitHub Security Advisories · osv
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.