Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 2
- StatusReceived → PublishedNVD modified 2026-10-28 19:00
- First seenCVSS 8.2NVD modified 2026-10-28 19:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec
- https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f
- https://github.com/labstack/echo/releases/tag/v4.16.1
- https://github.com/labstack/echo/releases/tag/v5.4.1
- https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5