Read the docs
TI-2026-82149 Aliases CVE-2026-118262

Resource leak in Echo WebSocket proxy after client disconnect

Priority LOW 35CWE-772Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-772.

Summary

Echo, a Go web framework, is affected from 4.15.0 before 4.16.1 and from 5.0.0 before 5.4.1. Its Proxy middleware does not reliably close the peer connection when one copy direction ends, so handlers, goroutines and network connections can remain after a WebSocket client disconnects while the upstream keeps its connection open (CWE-772). An unauthenticated remote attacker who can reach a proxy route can repeat connections so that resources accumulate, causing denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00302 23rd percentileScored 2026-11-07
Fix Fixed echo (labstack): 4.16.1, 5.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
labstackecho4.15.0 to before 4.16.1; 5.0.0 to before 5.4.14.16.1, 5.4.1Patch availableCNA
  • echo Vendorlabstack Affected 4.15.0 to before 4.16.1; 5.0.0 to before 5.4.1 Fixed in 4.16.1, 5.4.1 Patch available CNA

Remediation

Upgrade labstack/echo to version 4.16.1 in the 4.x line or to version 5.4.1 in the 5.x line.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA echo (labstack) Fixed in 4.16.1, 5.4.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118262
  2. 2026-10-30 Priority changed: MEDIUM → LOW
  3. 2026-11-03 CISA SSVC decision points changed
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Other 5

  • TI-2022-18981 Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the… CVSS 3.1CRITICAL 9.6
  • TI-2026-82185 Path decoding mismatch in Echo middleware.Static exposes static files CVSS 3.1HIGH 7.5
  • TI-2026-40198 Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files CVSS 3.1HIGH 7.5
  • TI-2026-82194 Rate limiter bypass in Echo via spoofed X-Forwarded-For header CVSS 3.1MEDIUM 5.3
  • TI-2026-20833 Echo has a Windows path traversal via backslash in middleware.Static default filesystem CVSS 3.1MEDIUM 5.3
  • TI-2020-18793 Directory traversal on Windows in github.com/labstack/echo/v4 CVSS 3.1MEDIUM 5.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences