All vulnerabilities
CVE-2026-118656GHSA-v753-g4cw-jm48

Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI

labstack echo
Open in ThreatlineRecord JSON
CVSS
6.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host. This issue is fixed in 4.16.0 and 5.4.0.

Text from CVE List

Affected versions 2

  • echoaffected: >= 5.0.0, < 5.4.0CVE List
  • echoaffected: < 4.16.0CVE List

References 5