{"id":"GO-2026-6883","revision":"e5d6887391b74d3a8a2567a82382b7ee","records":[{"revision":"e5d6887391b74d3a8a2567a82382b7ee","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6883","aliases":["CVE-2026-118656","GHSA-v753-g4cw-jm48"],"title":"Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo","description":"Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo","state":0,"publishedAt":"2026-11-05T22:54:32+00:00","modifiedAt":"2026-11-05T23:15:15.8618099+00:00","affected":[{"ecosystem":"Go","name":"github.com/labstack/echo/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.16.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/labstack/echo/v5","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"5.4.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48","https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1","https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af","https://github.com/labstack/echo/releases/tag/v4.16.0","https://github.com/labstack/echo/releases/tag/v5.4.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6883","license":"OSV · upstream source license applies","key":"osv:GO-2026-6883","identifiers":["GO-2026-6883","CVE-2026-118656","GHSA-v753-g4cw-jm48"]},"retained":false,"historicalAffected":[]}],"coverage":[]}