Vulnerability in Echo Framework Allows Scheme Header Trusting
CVE-2026-118657
5.9MEDIUM
What is CVE-2026-118657?
The Echo web framework has a vulnerability that allows unconditionally trusting forwarded scheme headers. This can lead to serious security risks, such as an attacker exploiting plaintext HTTP connections to falsely claim an HTTPS scheme, thereby bypassing important security features like HTTPSRedirect. Furthermore, if Echo is deployed behind a TLS-terminating proxy which forwards an attacker-controlled header, it can prevent the Strict-Transport-Security header from functioning correctly, even when the connection is secure. This vulnerability has been addressed in versions 4.16.0 and 5.4.0, which implement necessary safeguards to prevent these potential exploits.
Affected Version(s)
echo >= 5.0.0, < 5.4.0 < 5.0.0, 5.4.0
echo < 4.16.0 < 4.16.0