DEBIAN-CVE-2026-118656: Medium severity debian/golang-github-labstack-echo vulnerability

Published Oct 28, 2026

Updated

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.

Affected Software

3 affected components

debian/golang-github-labstack-echo*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Echo to a version that resolves this vulnerability.
Fixed in 4.16.0

Event History

Oct 28, 2026

CVE Published

via OSV·09:16 PM

Data Sourced

via OSV·09:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this redirect issue?

Applications using Echo versions before 4.16.0 or 5.4.0 are affected only when AddTrailingSlash or RemoveTrailingSlash is configured to issue a redirect. The vulnerable behavior is in redirect-target sanitization.

What must an attacker do to exploit it?

An attacker must cause a trailing-slash middleware redirect using a target beginning with a slash, TAB, separator path form. The malformed target can pass the guard, be placed in the Location header, and be normalized by the browser to an attacker-controlled host.

Does exploitation require authentication or user interaction?

The supplied vector indicates no attacker privileges are required. A user must interact with the redirect, such as by following a crafted link or otherwise triggering the affected redirect.

What is the remediation?

Upgrade Echo to version 4.16.0 or 5.4.0, which fix the redirect-target sanitization issue. If an immediate upgrade is not possible, avoid configuring AddTrailingSlash or RemoveTrailingSlash with redirect behavior.

DEBIAN-CVE-2026-118656: Medium severity debian/golang-github-labstack-echo vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this redirect issue?

What must an attacker do to exploit it?

Does exploitation require authentication or user interaction?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this redirect issue?

What must an attacker do to exploit it?

Does exploitation require authentication or user interaction?

What is the remediation?