URI Sanitization Issue in Echo Go Framework
CVE-2026-118656
6.1MEDIUM
What is CVE-2026-118656?
The Echo web framework, versions prior to 4.16.0 and 5.4.0, contains a URI sanitization flaw that allows an attacker to manipulate redirect targets. Specifically, the vulnerability occurs when the sanitizeURI function only inspects the first two bytes of a redirect before determining if it starts with an absolute-path separator. This can lead to improper normalization of the Location header, allowing potential redirection to an attacker-controlled host. To protect against exploitation of this issue, users are advised to update to the secure versions 4.16.0 or 5.4.0.
Affected Version(s)
echo >= 5.0.0, < 5.4.0 < 5.0.0, 5.4.0
echo < 4.16.0 < 4.16.0