UBUNTU-CVE-2026-118262: High severity ubuntu/golang-github-labstack-echo.v2 vulnerability
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.16.1 - Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.1
Frequently Asked Questions
Which deployments are exposed to resource exhaustion?
Deployments using Echo's Proxy middleware may be exposed when proxy routes are accessible and an upstream keeps its connection open after a WebSocket client disconnects. The impact depends on upstream behavior and configured connection deadlines.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network reachability, no privileges, and no user interaction are required; repeated connections are used to accumulate retained resources.
How can I determine whether an instance is affected?
Check whether the application uses Echo's Proxy middleware and identify its Echo version. The issue is fixed in Echo 4.16.1 and 5.4.1; versions starting at 4.15.0 before the applicable fixed release are affected.
What evidence may indicate active exploitation or exposure?
Look for handlers, copy goroutines, and network connections that remain after WebSocket clients disconnect, especially where upstream servers keep connections open or rejected upgrade responses use HTTP keep-alive. Repeated occurrences can progressively consume resources and lead to denial of service.