EUVD-2026-112394
GHSA-9969-6676-49h5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed WebSocket proxy route
-
DeliveryOpen connection / trigger rejected keep-alive upgrade
-
ExploitClient disconnect leaves upstream open
-
ExecutionLeak handler, goroutines and connections per attempt
-
ImpactRepeat to exhaust server resources (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup on lifecycle end
|
| Exploitation Conditions | Requires the application to use Echo's Proxy middleware with a WebSocket (raw) proxy route that is reachable by the attacker. The leak triggers when a client disconnects while the upstream keeps its side open - notably when a rejected upgrade response is returned over an HTTP keep-alive connection - so the proxy waits indefinitely on the still-open direction. Exploitation is unauthenticated (PR:N) but conditional (AT:P): it depends on proxy-route accessibility, upstream behavior (whether it holds the connection open), and configured connection deadlines. Limiting factors: applications not using the proxy WebSocket feature are unaffected, and bounded connection lifetimes or resource limits at the frontend/upstream constrain impact. The vendor notes server idle timeouts alone may not cover hijacked WebSocket connections. |
| Impact | This is a genuine but conditional availability risk, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) rated 8.2 reflects a network-reachable, unauthenticated flaw affecting availability only (VA:H; VC:N/VI:N), but the AT:P flag signals a real attack requirement - an upstream that keeps its connection open after the client disconnects - which the GHSA and description both confirm. The vuln.today decision label is 'this_week' (not act_now or emergency), consistent with a resource-retention DoS rather than code execution or data exposure. No EPSS score, no CISA KEV listing, and no proof-of-concept reference were provided; exploitation is therefore unproven. Signals are internally consistent (DoS-only impact, CWE-772 resource retention, vendor-described conditions) with no contradictions between CVSS vector and description. Net assessment: patch within a normal cadence; prioritize instances that expose a WebSocket proxy route to untrusted clients, since the practical risk depends heavily on route accessibility and upstream behavior. |
| Exploit ScenarioDerived | An attacker who can reach an Echo application configured with a WebSocket proxy route repeatedly opens connections that the upstream keeps open (for example by eliciting a rejected upgrade response delivered with HTTP keep-alive). Because the raw proxy waits on both copy directions without reliably closing the peer connection when one ends, each attempt leaks a handler, goroutines, and network connections, and repeated attempts accumulate until the server exhausts resources. No public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Denial of service in Labstack Echo's Proxy middleware (v4.15.0 through v4.16.0 and v5.0.0 through v5.4.0) lets unauthenticated remote clients tie up server resources by disconnecting from a WebSocket proxy route while the upstream keeps its side of the connection open, leaving the handler, copy goroutines and network connections retained instead of released. Repeated connections accumulate these leaked resources until the service is degraded or unavailable; only availability is affected, with no confidentiality or integrity impact claimed. Exploitation is conditional rather than trivial - it requires a reachable raw/WebSocket proxy route, an upstream that holds the connection open (a rejected upgrade response delivered over HTTP keep-alive is one such trigger), and permissive or absent connection deadlines. No public exploit code identified at time of analysis; vendor patches are available in 4.16.1 and 5.4.1.
RemediationAI
Vendor-released patch: upgrade to Echo v4.16.1 (github.com/labstack/echo/v4) or v5.4.1 (github.com/labstack/echo/v5) - the fix commits are 3fb0ba7e17645bb65611e2a08875d0a2f65c421f for v4 and 1855061e572ae9dab727c811d8382f266bfbaaec for v5, and release notes are at https://github.com/labstack/echo/releases/tag/v4.16.1 and https://github.com/labstack/echo/releases/tag/v5.4.1. Because the regressing change was a proxy rewrite (commit e2133320c7, PR #2852), teams that pinned v4.15.0-v4.16.0 or v5.0.0-v5.4.0 should bump the module and rebuild rather than cherry-picking middleware code. If upgrading cannot happen immediately, the vendor's documented workaround is to disable the WebSocket/raw proxy routes entirely until the upgrade lands, which removes the affected code path at the cost of any feature depending on it. As a supplementary control, apply bounded connection lifetimes and resource limits at the frontend and at the upstream - but be aware the vendor explicitly notes that server idle timeouts alone may not cover hijacked WebSocket connections, so plain read/write timeout tuning should not be treated as a substitute for patching. Prioritization can follow the intermediate decision signal (patch within the current week) given the conditional AT:P preconditions and availability-only impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Echo is a Go web framework, and the flaw sits in its Proxy middleware when it handles a raw (WebSocket/upgrade) proxy route. To tunnel upgraded traffic the middleware hijacks the client connection and runs two io.Copy loops, one per direction, then waits for both to finish. It does not reliably close the peer connection when one direction terminates, so if the client goes away but the upstream deliberately keeps its side open - or if a rejected upgrade response is returned over an HTTP keep-alive connection - the copy loop and its goroutine block indefinitely. The root cause class is CWE-772 (Missing Release of Resource after Effective Lifetime): a resource acquires a lifetime that is never terminated because the second copy direction never reaches EOF and nothing forces the pair to be torn down. The regression was introduced by commit e2133320c7, merged in pull request #2852, and the fix replaces the hand-rolled copy logic with Go's HTTP reverse proxy, preserves ordinary HTTP handling for rejected upgrades, and closes both sides of the tunnel when either direction ends - including the case where the upstream receives client EOF but keeps its side open. Note that the v5 fix commit referenced in the advisory also carries unrelated hardening to IP extraction (X-Real-IP trust checks) and BodyDump middleware behavior, so the full commit should be read rather than a single file diff. The 8.2 CVSS 4.0 base score reflects high availability impact under AT:P (the attack depends on conditions outside the attacker's full control), and the assessing vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H is consistent with that conditional, availability-only profile.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because exploitation needs an upstream that holds the connection open; availability-only impact (A:H, C:N/I:N).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.
Technical POC Analysis
CWE-772: Missing Release of Resource after Effective Lifetime.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
CVE-2026-118262 is a high-severity denial-of-service vulnerability in Labstack Echo's Proxy middleware, affecting versions 4.15.0 through 4.16.0 and 5.0.0 through 5.4.0. Unauthenticated attackers can exhaust server resources by repeatedly opening and closing WebSocket proxy connections, potentially causing service outages for any applications relying on the affected middleware. Leadership should prioritize remediation because this flaw directly threatens availability of internet-facing services and could disrupt business operations.
Apply vendor patch: upgrade to 4.16.1 or 5.4.1. If immediate patching is not possible, enforce aggressive connection deadlines and limit concurrent proxy connections to reduce resource exhaustion.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB