CVE-2026-118262

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.

• CWE-772

• https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec
• https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f
• https://github.com/labstack/echo/releases/tag/v4.16.1
• https://github.com/labstack/echo/releases/tag/v5.4.1
• https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118257Vue I18n is the internationalization plugin for Vue.js. From…7.2
• CVE-2026-118258i18next-http-backend is a backend layer for i18next that loa…3.7
• CVE-2026-118259opentelemetry-java is the Java implementation of the OpenTel…5.3
• CVE-2026-11826OpenPLC_v3 contains a heap-based buffer overflow in the getD…8.8
• CVE-2026-118260Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4…8.2
• CVE-2026-118261Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4…8.2
• CVE-2026-118263Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5'…6.3
• CVE-2026-118264Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.…9.1
• CVE-2026-118265Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5'…5.3
• CVE-2026-118266Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo'…5.3
• CVE-2026-11827GitLab has remediated an issue in GitLab EE affecting all ve…4.9
• CVE-2026-118271A security vulnerability has been detected in a2ui-project a…4.3