CVE-2026-118657GHSA-2ffq-g2xg-c22pGO-2026-6879

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

UnratedPublished 5 Nov 2026 · Updated 6 Nov 2026

01Description

Verified · OSV

02Analysis

AI analysis

Not analysed yet.

Claude analyses new vulnerabilities after each morning's collection, most important first, up to a daily limit. The verified data on this page is complete without it.

03Affected software

2 entries

Affected products and versions
Product	Affected versions	Fixed in	Source
github.com/labstack/echo/v4Go	`< 4.16.0`	`4.16.0`	OSV
github.com/labstack/echo/v5Go	`< 5.4.0`	`5.4.0`	OSV

04Weaknesses

Verified

No weakness classification (CWE) has been assigned yet.

05References

6 links

Advisories1

github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22padvisoryvia OSV(opens in a new tab)

Patches and fixes4

github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1fixvia OSV(opens in a new tab)

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

01Description

02Analysis

03Affected software

04Weaknesses

05References

Advisories1

Patches and fixes4

Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo

01Description

02Analysis

03Affected software

04Weaknesses

05References

Advisories1

Patches and fixes4

Other references1

History

Sources

Same product or vendor