GO-2026-6838: Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo
Published Nov 5, 2026
·Updated
Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo
Affected Software
2 affected componentsFixes available
go/github.com/labstack/echo/v4>=4.15.0<4.16.1
4.16.1
go/github.com/labstack/echo/v5>=5.0.0<5.4.1
5.4.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/labstack/echo/v4to a version that resolves this vulnerability.Fixed in 4.16.1 - Upgrade
Upgrade
go/github.com/labstack/echo/v5to a version that resolves this vulnerability.Fixed in 5.4.1
Event History
Nov 5, 2026
Advisory Published
via OSV·10:54 PM
Data Sourced
via OSV·10:54 PM
DescriptionAffected Software
Frequently Asked Questions
1
Which Go module paths are affected?
The affected module paths are github.com/labstack/echo/v4 and github.com/labstack/echo/v5.