CVE-2026-118657: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.16.0 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.0 - Compensating control
Ensure a trusted TLS-terminating proxy overwrites forwarded scheme headers and prevent direct access to the backend.
Event History
Frequently Asked Questions
Which deployments are realistically exposed to the redirect bypass?
Deployments are exposed when clients can reach the Echo application directly over plaintext HTTP. Such a client can claim an HTTPS scheme in forwarded headers, causing HTTPSRedirect to treat the request as already secure.
When can HSTS be suppressed despite the browser using HTTPS?
This can occur behind a TLS-terminating proxy if the proxy passes through an attacker-controlled forwarded scheme header. A client can claim an HTTP scheme, causing Echo to omit the Strict-Transport-Security header even though the response is delivered over HTTPS.
What mitigations are available if upgrading is not immediately possible?
Prevent direct access to the Echo backend and configure the trusted proxy to overwrite forwarded scheme headers rather than passing client-supplied values. These controls reduce the practical risk described for both behaviors.
Which releases contain the fix?
The issue is fixed in Echo 4.16.0 and 5.4.0. Versions prior to those releases are affected.