DEBIAN-CVE-2026-118264: Critical severity debian/golang-github-labstack-echo vulnerability

Published Oct 28, 2026

Updated

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.

Affected Software

3 affected components

debian/golang-github-labstack-echo*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Echo to a version that resolves this vulnerability.
Fixed in 4.16.1
Upgrade
Upgrade Echo to a version that resolves this vulnerability.
Fixed in 5.4.1

Event History

Oct 28, 2026

CVE Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed to this bypass?

Deployments are exposed when they provide an accessible Echo proxy route, enforce authentication or authorization only through Echo routes or route-specific middleware, and proxy to an upstream that does not independently authorize requests. The upstream must also return an ordinary keep-alive response when rejecting a WebSocket upgrade.

What does an attacker need to exploit the issue?

An attacker needs network access to the vulnerable Echo proxy route and must send a WebSocket upgrade request that causes the configured upstream to reject the upgrade while keeping the connection alive. They can then send later HTTP requests on that connection directly to the upstream, bypassing Echo's router and route-specific middleware.

Are all Echo versions affected?

No. The issue affects Echo versions from 4.0.0 up to the fixed 4.16.1 release, and version 5 releases before 5.4.1. Echo 4.16.1 and 5.4.1 contain the fix.

What can be done if updating Echo is not immediately possible?

Ensure upstream services behind Echo enforce their own authentication and authorization rather than relying only on Echo route middleware. Restrict access to proxy routes where possible and avoid upstream behavior that returns a keep-alive response after rejecting a WebSocket upgrade.

DEBIAN-CVE-2026-118264: Critical severity debian/golang-github-labstack-echo vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed to this bypass?

What does an attacker need to exploit the issue?

Are all Echo versions affected?

What can be done if updating Echo is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to this bypass?

What does an attacker need to exploit the issue?

Are all Echo versions affected?

What can be done if updating Echo is not immediately possible?