{"schema_version":"1.9.2","id":"GO-2026-6878","published":"2026-11-05T22:54:32Z","modified":"2026-11-05T23:15:15.416084165Z","aliases":["CVE-2026-118658","GHSA-23wf-92cp-8pcj"],"summary":"Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo","details":"Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo","affected":[{"package":{"name":"github.com/labstack/echo/v4","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.15.2"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/labstack/echo/v4","symbols":["context.Scheme"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6878.json"}},{"package":{"name":"github.com/labstack/echo/v5","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.1.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/labstack/echo/v5","symbols":["Context.Scheme"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6878.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj"},{"type":"FIX","url":"https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181"},{"type":"FIX","url":"https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df"},{"type":"FIX","url":"https://github.com/labstack/echo/pull/2953"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v4.15.2"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v5.1.1"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6878"}}