Echo: WebSocket proxy can retain connections and handlers after client disconnect

At a glance

github.com/labstack/echo/v4: Amber, patch this week. Echo, a Go web framework, has a vulnerability where rejected WebSocket upgrades can bypass access controls. An attacker could exploit this to send HTTP requests directly to an upstream without passing through Echo's router or route-specific middleware.

The flaws

• CVE-2026-118262: Echo: WebSocket proxy can retain connections and handlers after client disconnect (CVSS 8.2)
• CVE-2026-118264: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls (CVSS 9.1)
• CVE-2026-118261: Echo: Decompress permits unbounded gzip expansion in v4 (CVSS 8.2)
• CVE-2026-118260: Echo: BodyDump captures request and response bodies without size limits in v4 (CVSS 8.2)

The fix

Upgrade github.com/labstack/echo/v4: 4.16.1 · 5.4.1 or later on your release line

Who is exposed: {'products': ['Echo'], 'packages': [{'ecosystem': 'go', 'name': 'github.com/labstack/echo/v4', 'vulnerable': '>= 4.0.0, < 4.16.1'}, {'ecosystem': 'go', 'name': 'github.com/labstack/echo/v5', 'vulnerable': '>= 5.0.0, < 5.4.1'}]}

Where it stands

• No known exploitation

Connects to

• Same weakness: CWE-772 (CWE-772). 10 other warnings in 30 days