CVE-2026-118262: Echo: WebSocket proxy can retain connections and handlers after client disconnect
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.16.1 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.1
Event History
Frequently Asked Questions
Which deployments are most exposed to resource exhaustion?
Deployments with accessible Proxy middleware routes that proxy WebSocket traffic are exposed when their upstream can keep connections open after a client disconnects. Repeated connections can accumulate retained handlers, copy goroutines, and network connections, with the impact also depending on configured connection deadlines.
What conditions are needed to trigger the retention?
A WebSocket client must disconnect while the upstream connection remains open. The issue can also occur when an upgrade is rejected and the response uses HTTP keep-alive, because the raw proxy may wait for both copy directions without reliably closing the peer connection.
Are supported fixed releases available?
Yes. The issue is fixed in Echo 4.16.1 and 5.4.1. Affected versions begin at 4.15.0 and continue until those fixed releases.