Is CVE-2026-118656 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118656 being exploited in the wild.

How severe is CVE-2026-118656?

Medium severity, with a CVSS score of 6.1, published 28 October 2026.

Which products and versions are affected?

github.com/labstack/echo/v4 (Go) < 4.16.0, SEMVER:introduced=0,fixed=4.16.0; github.com/labstack/echo/v5 (Go) < 5.4.0, SEMVER:introduced=0,fixed=5.4.0; Labstack Echo before 4.16.0 and before 5.4.0.

Is there a fix for CVE-2026-118656?

Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.0 or later; github.com/labstack/echo/v5 (Go): upgrade to 5.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118656 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118656?

Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118656: Echo open redirect in sanitizeURI with trailing slash redirect

Q: Is there a fix for CVE-2026-118656?

Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.0 or later; github.com/labstack/echo/v5 (Go): upgrade to 5.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118656 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-118656?

Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118656 · Severity: medium · CVSS 6.1 · Published 2026-10-28

Echo is a popular Go web framework used to build REST APIs and web applications. When configured to automatically add or remove trailing slashes with a redirect response, a flaw in the URI sanitization logic allows attackers to craft URLs that bypass the redirect guard and redirect users to arbitrary websites, potentially leading to phishing attacks or credential theft.

Technologies: github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go), Labstack Echo. Vendors: Go, Labstack.

Quick answers

Is CVE-2026-118656 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118656 being exploited in the wild.
How severe is CVE-2026-118656?: Medium severity, with a CVSS score of 6.1, published 28 October 2026.
Which products and versions are affected?: github.com/labstack/echo/v4 (Go) < 4.16.0, SEMVER:introduced=0,fixed=4.16.0; github.com/labstack/echo/v5 (Go) < 5.4.0, SEMVER:introduced=0,fixed=5.4.0; Labstack Echo before 4.16.0 and before 5.4.0.
Is there a fix for CVE-2026-118656?: Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.0 or later; github.com/labstack/echo/v5 (Go): upgrade to 5.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118656 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118656?: Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/labstack/echo/v4 (Go): upgrade to 4.16.0 or later
```
go get github.com/labstack/echo/v4@v4.16.0
```
github.com/labstack/echo/v5 (Go): upgrade to 5.4.0 or later
```
go get github.com/labstack/echo/v5@v5.4.0
```

Technical details

The sanitizeURI function checks only the first two bytes of a redirect target to detect absolute-path separators (//). An attacker can embed a tab character (0x09) or other control character before the double slash in a crafted path like /%09/evil.example/, which is normalized by browsers and bypasses the validation. This occurs in the AddTrailingSlash and RemoveTrailingSlash middleware when configured with a redirect response, allowing the attacker-controlled host to appear in the Location header.

Affected products

labstack Echo before 4.16.0 and before 5.4.0

Identifiers

CVE-2026-118656
GHSA-v753-g4cw-jm48
GO-2026-6883

Timeline

2026-10-28: disclosed: CVE-2026-118656 published
2026-09-27: patched: Fix merged in v4.16.0 and v5.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.