UBUNTU-CVE-2026-118658: Medium severity ubuntu/golang-github-labstack-echo.v2 vulnerability
Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected. This issue is fixed in 4.15.2 and 5.1.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.15.2 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.1.1
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An application must use an affected Echo version and the WWWRedirect or NonWWWRedirect middleware. The attacker must be able to supply a forwarded scheme header, and a user must interact with the resulting redirect response.
Are all Echo HTTPS redirect configurations affected?
No. The HTTPS-specific redirect variants hardcode the HTTPS scheme and are not affected by this issue.
Which forwarded headers can be abused?
The affected Context.Scheme behavior accepts values from X-Forwarded-Proto, X-Forwarded-Protocol, and X-Url-Scheme without validating that the value is a supported web scheme.
What versions contain the fix?
The issue is fixed in Echo versions 4.15.2 and 5.1.1.