UBUNTU-CVE-2026-118656: Security vulnerability
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.16.0 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.0
Event History
Frequently Asked Questions
Which deployments are exposed to this redirect issue?
Deployments using Echo versions earlier than 4.16.0 or 5.4.0 are exposed when AddTrailingSlash or RemoveTrailingSlash is configured to issue a redirect. The issue affects redirect targets that can contain a slash followed by a TAB and a separator path form.
What does an attacker need to exploit it?
An attacker needs to cause a request that reaches the configured trailing-slash redirect behavior with a crafted redirect target. The vulnerable URI sanitization checks only the first two bytes, allowing the crafted value to be placed in the Location header and normalized by a browser to an attacker-controlled host.
Are default Echo configurations affected?
The provided information identifies exposure only when AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status. It does not establish that an otherwise default Echo configuration is affected.
What should be done if an affected redirect configuration is in use?
Upgrade to Echo 4.16.0 or 5.4.0, depending on the major version in use. If upgrading is not immediately possible, avoid configuring AddTrailingSlash or RemoveTrailingSlash to issue redirects.