Denial of Service Vulnerability in Echo Framework by Labstack
CVE-2026-118262
8.2HIGH
What is CVE-2026-118262?
The Echo web framework has a vulnerability that allows its Proxy middleware to inefficiently manage resources. When a WebSocket client disconnects but the upstream keeps its connection open, the proxy can erroneously retain handlers, goroutines, and active network connections. This flawed behavior may lead to resource accumulation over repeated connections, ultimately increasing the risk of denial of service. This issue has been addressed in the latest versions 4.16.1 and 5.4.1, which ensure proper closure of connections when one side ends.
Affected Version(s)
echo >= 4.15.0, < 4.16.1 < 4.15.0, 4.16.1
echo >= 5.0.0, < 5.4.1 < 5.0.0, 5.4.1