{"affected":[{"product":"echo","source":"CNA: GitHub_M","vendor":"labstack","versions":[{"status":"affected","version":">= 5.0.0, < 5.4.0"},{"status":"affected","version":"< 4.16.0"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v5","product":"github.com/labstack/echo/v5","source":"OSV GHSA-2ffq-g2xg-c22p","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"5.4.0"}],"lessThan":"5.4.0","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v4","product":"github.com/labstack/echo/v4","source":"OSV GHSA-2ffq-g2xg-c22p","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"4.16.0"}],"lessThan":"4.16.0","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118657","cwes":["CWE-346"],"description":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0.","epss":{"date":"2026-11-02","percentile":0.02825,"score":0.00133},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p"}],"kev":null,"metrics":[{"score":5.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.1"}],"modifiedAt":1793712722816,"publishedAt":1793218449883,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v4.16.0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v5.4.0"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-2ffq-g2xg-c22p"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-2ffq-g2xg-c22p"}],"remediation":[{"kind":"fix","source":"OSV GHSA-2ffq-g2xg-c22p","text":"github.com/labstack/echo/v5 (Go): OSV reports a fixed version 5.4.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-2ffq-g2xg-c22p"},{"kind":"fix","source":"OSV GHSA-2ffq-g2xg-c22p","text":"github.com/labstack/echo/v4 (Go): OSV reports a fixed version 4.16.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-2ffq-g2xg-c22p"}],"revision":"6753e1baf9a1c41cf6d3b289e537cb86f33cb57262db7ad0bf7eded7950656f9","sources":[{"modifiedAt":1793712722816,"name":"CNA: GitHub_M","retrievedAt":1793714952186,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118657"},{"modifiedAt":1793222104156,"name":"OSV / GitHub Security Advisories","retrievedAt":1793714953089,"url":"https://osv.dev/vulnerability/GHSA-2ffq-g2xg-c22p"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793714964074,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118657"}],"ssvc":{"assessedAt":1793712694902,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers","updatedAt":1793714964074}