{"affected":[{"product":"echo","source":"CNA: GitHub_M","vendor":"labstack","versions":[{"status":"affected","version":">= 5.0.0, < 5.1.1"},{"status":"affected","version":"< 4.15.2"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v5","product":"github.com/labstack/echo/v5","source":"OSV GHSA-23wf-92cp-8pcj","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"5.1.1"}],"lessThan":"5.1.1","status":"affected","version":"0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v4","product":"github.com/labstack/echo/v4","source":"OSV GHSA-23wf-92cp-8pcj","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"4.15.2"}],"lessThan":"4.15.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118658","cwes":["CWE-601"],"description":"Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1.","epss":{"date":"2026-11-02","percentile":0.08174,"score":0.00186},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj"}],"kev":null,"metrics":[{"score":4.7,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1793652262513,"publishedAt":1793218631083,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v4.15.2"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v5.1.1"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-23wf-92cp-8pcj"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-23wf-92cp-8pcj"}],"remediation":[{"kind":"fix","source":"OSV GHSA-23wf-92cp-8pcj","text":"github.com/labstack/echo/v5 (Go): OSV reports a fixed version 5.1.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-23wf-92cp-8pcj"},{"kind":"fix","source":"OSV GHSA-23wf-92cp-8pcj","text":"github.com/labstack/echo/v4 (Go): OSV reports a fixed version 4.15.2. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-23wf-92cp-8pcj"}],"revision":"24502cb9d788a62ed347d65b7a9b0b7a8e56729af560a55eea28ba1873183fef","sources":[{"modifiedAt":1793652262513,"name":"CNA: GitHub_M","retrievedAt":1793653771180,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118658"},{"modifiedAt":1793222104154,"name":"OSV / GitHub Security Advisories","retrievedAt":1793653774679,"url":"https://osv.dev/vulnerability/GHSA-23wf-92cp-8pcj"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793653773443,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118658"}],"ssvc":{"assessedAt":1793652235876,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto","updatedAt":1793653774679}