UBUNTU-CVE-2026-118657: Medium severity ubuntu/golang-github-labstack-echo.v2 vulnerability
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.16.0 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.0 - Compensating control
Ensure a trusted TLS-terminating proxy overwrites forwarded scheme headers and prevent direct access to the backend.
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Deployments are most exposed when clients can reach Echo directly over plaintext HTTP, or when Echo sits behind a TLS-terminating proxy that forwards attacker-controlled scheme headers. Risk is reduced if the proxy overwrites these headers and direct access to the backend is blocked.
What can an attacker do if they can control forwarded scheme headers?
A client reaching Echo over plaintext HTTP can claim HTTPS and bypass HTTPSRedirect. Behind a TLS-terminating proxy, a claimed HTTP scheme can prevent Echo from sending the Strict-Transport-Security header on an HTTPS response.
What versions contain the fix?
The issue is fixed in Echo 4.16.0 and 5.4.0. Versions before those releases are affected according to the available information.
What can be done before updating?
Prevent direct client access to the Echo backend and configure the trusted TLS-terminating proxy to overwrite forwarded scheme headers rather than passing client-supplied values. This reduces the practical risk described for affected versions.