Zero Radar
← feed
HighVulnerabilityCVE-2026-118262updated 28 Oct 2026, 19:17 UTC

Echo web framework proxy can leak connections and goroutines, enabling denial of service

If your app forwards WebSocket connections through Echo's built-in proxy, clients that disconnect can leave server resources stuck open. Enough of these can slow or crash the server.

Fix availableOfficial, 2 sources
SeverityHighCVSS 8.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesgithub.com/labstack/echo/v4 4.16.1; github.com/labstack/echo/v5 5.4.1 · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Client opens WebSocketConnects through the Echo proxy route
  2. 2Client disconnectsOne side of the tunnel ends
  3. 3Echo keeps resources openOther side is not reliably closed
  4. 4Resources accumulateRepeated connections pile up
  5. ResultServer runs out of resources

What happened

Echo's Proxy middleware fails to reliably close both sides of a WebSocket tunnel when one side ends and the upstream keeps its connection open, retaining handlers, goroutines and network connections. A rejected upgrade with HTTP keep-alive can trigger it.

Why it is dangerous: Repeated connections can accumulate resources until the service becomes unavailable. Anyone who can reach the proxy route and its upstream behavior affects the risk.

Are you affected?

You are affected if you run Echo v4.15.0 through v4.16.0, or Echo v5.0.0 through v5.4.0, and use the Proxy middleware for WebSocket routes.

Package / productAffected versionsFixed in
github.com/labstack/echo/v4 · go>= 4.15.0, < 4.16.14.16.1
github.com/labstack/echo/v5 · go>= 5.0.0, < 5.4.15.4.1

What to do

  1. Upgrade github.com/labstack/echo/v4 to 4.16.1 or later, or github.com/labstack/echo/v5 to 5.4.1 or later
  2. Until you upgrade, disable WebSocket proxy routes
  3. If you cannot upgrade yet, set bounded connection lifetimes and resource limits at the frontend and upstream, since server idle timeouts alone may not cover hijacked WebSocket connections

Timeline

  1. 23 Oct 2026, 20:50 UTC
    Publicly disclosed
  2. 23 Oct 2026, 20:50 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 28 Oct 2026, 19:17 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118262 · GHSA-9969-6676-49h5
CVSS
8.2 / 10
Disclosed
23 Oct 2026, 20:50 UTC
On Zero Radar
before the radar started
Last change
28 Oct 2026, 19:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Echo web framework proxy can leak connections and goroutines, enabling denial of service · Zero Radar