CVE-2026-118657

Name of the Vulnerable Software and Affected Versions Echo versions prior to 4.16.0 Echo versions prior to 5.4.0

Description The Context.Scheme function unconditionally trusts forwarded scheme headers from any client. This allows a client connecting via plaintext HTTP to claim an HTTPS scheme, bypassing the HTTPSRedirect mechanism by making the request appear secure. Additionally, when used behind a TLS-terminating proxy that forwards attacker-controlled headers, a claimed HTTP scheme can suppress the Strict-Transport-Security header, even if the browser receives the response over HTTPS. This occurs because the framework lacks a trusted-source configuration for these headers.

Recommendations Update to version 4.16.0. Update to version 5.4.0.