CVE-2026-118264 · GHSA-cxf3-9h37-7rr8

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Risk score: 65/100
CVSS: 9.1 v4.0
Published: 23 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Echo, a Go web framework, has a vulnerability where rejected WebSocket upgrades can bypass access controls. An attacker could exploit this to send HTTP requests directly to an upstream without passing through Echo's router or route-specific middleware.
Affected: {'products': ['Echo'], 'packages': [{'ecosystem': 'go', 'name': 'github.com/labstack/echo/v4', 'vulnerable': '>= 4.0.0, < 4.16.1'}, {'ecosystem': 'go', 'name': 'github.com/labstack/echo/v5', 'vulnerable': '>= 5.0.0, < 5.4.1'}]}
Fix: Upgrade to version 4.16.1 or 5.4.1
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/labstack/echo/v4: Amber, patch this week. Echo, a Go web framework, has a vulnerability where rejected WebSocket upgrades can bypass access controls. An attacker could exploit this to send HTTP requests directly to an upstream without passing through Echo's router or route-specific middleware.

The flaws

CVE-2026-118264: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls (CVSS 9.1)
CVE-2026-118262: Echo: WebSocket proxy can retain connections and handlers after client disconnect (CVSS 8.2)
CVE-2026-118261: Echo: Decompress permits unbounded gzip expansion in v4 (CVSS 8.2)
CVE-2026-118260: Echo: BodyDump captures request and response bodies without size limits in v4 (CVSS 8.2)

The fix

Upgrade github.com/labstack/echo/v4: 4.16.1 · 5.4.1 or later on your release line

Who is exposed: {'products': ['Echo'], 'packages': [{'ecosystem': 'go', 'name': 'github.com/labstack/echo/v4', 'vulnerable': '>= 4.0.0, < 4.16.1'}, {'ecosystem': 'go', 'name': 'github.com/labstack/echo/v5', 'vulnerable': '>= 5.0.0, < 5.4.1'}]}

Where it stands

No known exploitation

Connects to

Same weakness: CWE-444 (CWE-444). 29 other warnings in 30 days

Why it is Amber

CVSS 9.1 critical
Remotely exploitable without logging in
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/labstack/echo/v4	go	>= 4.0.0, < 4.16.1	4.16.1
github.com/labstack/echo/v5	go	>= 5.0.0, < 5.4.1	5.4.1

References

Original description

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.

Last activity 28 Oct 2026. Patch Forecast updates every hour.