GHSA-2ffq-g2xg-c22p — Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

Affected: Go: github.com/labstack/echo/v5, Go: github.com/labstack/echo/v4

## Description

`Context.Scheme()` unconditionally trusts four client-controlled HTTP headers to determine the request scheme, with no mechanism to configure trusted sources. This allows a remote unauthenticated attacker to bypass HTTPS redirect enforcement and suppress HSTS headers.

The trusted headers (checked in this order of precedence): 1. `X-Forwarded-Proto` 2. `X-Forwarded-Protocol` 3. `X-Forwarded-Ssl` 4. `X-Url-Scheme`

### Threat model

**Scenario A — Directly exposed application (vulnerable by default):** The Echo application listens on HTTP and is reachable directly by clients (no L7 proxy in front), or an attacker can bypass the proxy and reach the backend directly. In this case, the attacker has full control over all request headers. Sending `X-Forwarded-Proto: https` defeats the `HTTPSRedirect` middleware entirely — traffic stays on plaintext HTTP, enabling man-in-the-middle attacks.

This is the primary scenario. The application is vulnerable by default with no misconfiguration required — simply using `e.Pre(middleware.HTTPSRedirect())` as documented is sufficient.

**Scenario B — Behind L7 proxy with header sanitization (reduced risk):** If the application is strictly behind a correctly configured L7 proxy that always overwrites `X-Forwarded-Proto` and there is no direct access to the backend, the practical risk is lower. However, this relies on perimeter controls external to the framework, not on the framework itself. As Echo's own IP-extraction documentat…

UBUNTU-CVE-2026-118657

Affected: Ubuntu:20.04:LTS: golang-github-labstack-echo.v2, Ubuntu:20.04:LTS: golang-github-labstack-echo.v3, Ubuntu:22.04:LTS: golang-github-labstack-echo, Ubuntu:22.04:LTS: golang-github-labstack-echo.v2, Ubuntu:22.04:LTS: golang-github-labstack-echo.v3, Ubuntu:24.04:LTS: golang-github-labstack-echo, Ubuntu:26.10: golang-github-labstack-echo, Ubuntu:26.04:LTS: golang-github-labstack-echo

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS. The practical risk is reduced when a trusted proxy overwrites the headers and direct backend access is prevented, but the framework previously had no trusted-source configuration for this decision. This issue is fixed in 4.16.0 and 5.4.0.

Most recent entries from all

GHSA-2ffq-g2xg-c22p — Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers

UBUNTU-CVE-2026-118657