CVE-2026-118656
Medium
Description
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.
SeverityMedium
CVSS6.1
Exploit probability—
ProductGithub.com/labstack/echo/v5
PublishedOct 28, 2026
First seenNov 4, 2026
Weakness typeCWE-601Open redirect
How to fix
Update
- github.com/labstack/echo/v55.4.0 or later
- github.com/labstack/echo/v44.16.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/labstack/echo/v5Go | v < 5.4.0 | 5.4.0 |
| github.com/labstack/echo/v4Go | v < 4.16.0 | 4.16.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.