Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118262— Echo: WebSocket proxy can retain connections and handlers after client disconnect

Quick assessment

Affected
labstack echo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Echo 是一个用 Go 语言编写的 Web 框架。在 4.15.0 至 4.16.1 版本以及 5.4.1 版本中，Echo 的代理（Proxy）中间件存在一个问题：当 WebSocket 客户端断开连接但上游服务器仍保持连接时，该中间件可能会保留处理器、复制 goroutine 并维持网络连接。原始代理在两个传输方向上等待数据，无法在任一方向结束时可靠地关闭对端连接；这包括在升级请求被拒绝且响应使用了 HTTP 保持连接（Keep-Alive）的情况。重复的连接会导致资源累积，从而引发拒绝服务（DoS）攻击，具

CVSS 8.2 · High

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 2

VendorProduct Version RangeStatus
labstack echo >= 4.15.0, < 4.16.1 affected
>= 5.0.0, < 5.4.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118262

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Echo: WebSocket proxy can retain connections and handlers after client disconnect
Source: CVE Program / CVE List V5
Vulnerability Description
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对已超过有效生命周期的资源丧失索引
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
labstack echo >= 4.15.0, < 4.16.1 -

II. Public POCs for CVE-2026-118262

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118262

请登录查看更多情报信息。

Other References for CVE-2026-118262 (5)

Same Patch Batch · labstack · 2026-10-28 · 16 CVEs total

CVE-2026-118264 9.1 CRITICAL Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
CVE-2026-118260 8.2 HIGH Echo: BodyDump captures request and response bodies without size limits in v4
CVE-2026-118261 8.2 HIGH Echo: Decompress permits unbounded gzip expansion in v4
CVE-2026-118650 7.5 HIGH Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a sta
CVE-2026-118263 6.3 MEDIUM Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
CVE-2026-118652 6.1 MEDIUM Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP
CVE-2026-118656 6.1 MEDIUM Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI
CVE-2026-118654 5.9 MEDIUM Echo static file middleware route protection bypass via encoded dot-dot traversal
CVE-2026-118655 5.9 MEDIUM Echo: Static Middleware Double-Unescape Path Traversal
CVE-2026-118657 5.9 MEDIUM Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
CVE-2026-118651 5.3 MEDIUM Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
CVE-2026-118266 5.3 MEDIUM Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method
CVE-2026-118265 5.3 MEDIUM Echo: X-Real-IP extractor trusts the header value instead of the sending peer
CVE-2026-118653 5.3 MEDIUM Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
CVE-2026-118658 4.7 MEDIUM Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded

IV. Related Vulnerabilities

Same product: echo
Same vendor: labstack
Same weakness: CWE-772