{"id":"EUVD-2026-112463","enisaUuid":"6e83e816-5a76-3cda-988e-a58a8f086151","description":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.","datePublished":"Oct 28, 2026, 8:12:13 PM","dateUpdated":"Oct 29, 2026, 5:23:39 PM","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48\nhttps://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1\nhttps://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af\nhttps://github.com/labstack/echo/releases/tag/v4.16.0\nhttps://github.com/labstack/echo/releases/tag/v5.4.0\n","aliases":"CVE-2026-118656\nGHSA-v753-g4cw-jm48\n","assigner":"GitHub_M","epss":0.2,"enisaIdProduct":[{"id":"dc2f2e7e-49e5-3160-9877-81d62d4b5464","product":{"name":"Echo","vendor":{"name":"Wikimedia Foundation"}},"product_version":"5.0.0, \u003c 5.4.0"},{"id":"dcfd9127-529c-3d58-a3fe-daad79d94d91","product":{"name":"Echo","vendor":{"name":"Wikimedia Foundation"}},"product_version":"\u003c 4.16.0"}],"enisaIdVendor":[{"id":"fcfe7021-0075-334e-a9b1-347309daa104","vendor":{"name":"labstack"}}],"enisaIdVulnerability":[{"id":"c1592807-8d9a-39a8-81b6-a51360f08d0f","vulnerability":{"id":"GHSA-v753-g4cw-jm48","description":"Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI","datePublished":"Oct 28, 2026, 9:04:22 PM","dateUpdated":"Oct 28, 2026, 9:04:22 PM","baseScore":0.0,"references":"https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48\nhttps://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1\nhttps://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af\nhttps://github.com/labstack/echo\nhttps://github.com/labstack/echo/releases/tag/v4.16.0\nhttps://github.com/labstack/echo/releases/tag/v5.4.0\n","enisa_id":"EUVD-2026-112463\n","aliases":"GHSA-v753-g4cw-jm48\nCVE-2026-118656\n","epss":0.0,"dataProcessed":"Nov 5, 2026, 7:03:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d17727dd-395f-3c2c-b96f-2afadb9d58b1","vulnerability":{"id":"CVE-2026-118656","description":"Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.","datePublished":"Oct 28, 2026, 8:12:13 PM","dateUpdated":"Oct 29, 2026, 5:23:39 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48\nhttps://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1\nhttps://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af\nhttps://github.com/labstack/echo/releases/tag/v4.16.0\nhttps://github.com/labstack/echo/releases/tag/v5.4.0\n","enisa_id":"EUVD-2026-112463\n","assigner":"GitHub_M","epss":0.2,"dataProcessed":"Nov 5, 2026, 7:16:11 AM","vulnerabilityProduct":[{"id":"1c1fae2b-8c2f-3101-8202-ad86e4ffbf0b","product":{"name":"Echo","vendor":{"name":"Wikimedia Foundation"}},"product_version":"5.0.0, \u003c 5.4.0"},{"id":"c2f9c243-538a-320c-8074-707e63673729","product":{"name":"Echo","vendor":{"name":"Wikimedia Foundation"}},"product_version":"\u003c 4.16.0"}],"vulnerabilityVendor":[{"id":"a70da97b-663c-371b-a368-28e2f9cda2f2","vendor":{"name":"labstack"}}]}}],"enisaIdAdvisory":[]}