GO-2026-6879Published
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-118657 · CVE overview and exploitation status
cve-program · CVE-2026-118657
- https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p
- https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
- https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
- https://github.com/labstack/echo/releases/tag/v4.16.0
- https://github.com/labstack/echo/releases/tag/v5.4.0
euvd · EUVD-2026-112464
- https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p
- https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
- https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
- https://github.com/labstack/echo/releases/tag/v4.16.0
- https://github.com/labstack/echo/releases/tag/v5.4.0
nvd · CVE-2026-118657
- https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
- https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
- https://github.com/labstack/echo/releases/tag/v4.16.0
- https://github.com/labstack/echo/releases/tag/v5.4.0
- https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p
osv · GHSA-2ffq-g2xg-c22p
- https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p
- https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
- https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
- https://github.com/labstack/echo
- https://github.com/labstack/echo/releases/tag/v4.16.0
- https://github.com/labstack/echo/releases/tag/v5.4.0
osv · GO-2026-6879
- https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p
- https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1
- https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af
- https://github.com/labstack/echo/releases/tag/v4.16.0
- https://github.com/labstack/echo/releases/tag/v5.4.0
Related changes
Linked by CVE identifier- Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo · Newly collected advisory · 5 Nov 2026
- Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers · Advisory content revised · 5 Nov 2026
- Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirec… · Advisory content revised · 30 Oct 2026
- Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirec… · Advisory content revised · 30 Oct 2026