CVE-2026-118262

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118262", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-27T20:13:55.314Z", "datePublished": "2026-10-28T19:00:12.315Z", "dateUpdated": "2026-11-03T13:24:52.129Z"}, "containers": {"cna": {"title": "Echo: WebSocket proxy can retain connections and handlers after client disconnect", "problemTypes": [{"descriptions": [{"cweId": "CWE-772", "lang": "en", "description": "CWE-772: Missing Release of Resource after Effective Lifetime", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5"}, {"name": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"}, {"name": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"}, {"name": "https://github.com/labstack/echo/releases/tag/v4.16.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/releases/tag/v4.16.1"}, {"name": "https://github.com/labstack/echo/releases/tag/v5.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/releases/tag/v5.4.1"}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"version": ">= 4.15.0, < 4.16.1", "status": "affected"}, {"version": ">= 5.0.0, < 5.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T19:00:12.315Z"}, "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1."}], "source": {"advisory": "GHSA-9969-6676-49h5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T13:24:40.679951Z", "id": "CVE-2026-118262", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T13:24:52.129Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118262", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T13:24:40.679951Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T13:24:47.036Z"}}], "cna": {"title": "Echo: WebSocket proxy can retain connections and handlers after client disconnect", "source": {"advisory": "GHSA-9969-6676-49h5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"status": "affected", "version": ">= 4.15.0, < 4.16.1"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.1"}]}], "references": [{"url": "https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5", "name": "https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec", "name": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f", "name": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/releases/tag/v4.16.1", "name": "https://github.com/labstack/echo/releases/tag/v4.16.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/releases/tag/v5.4.1", "name": "https://github.com/labstack/echo/releases/tag/v5.4.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-772", "description": "CWE-772: Missing Release of Resource after Effective Lifetime"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T19:00:12.315Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118262", "state": "PUBLISHED", "dateUpdated": "2026-11-03T13:24:52.129Z", "dateReserved": "2026-10-27T20:13:55.314Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T19:00:12.315Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "echo", "vendor": "labstack", "versions": [{"status": "affected", "version": ">= 4.15.0, < 4.16.1"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1."}, {"lang": "es", "value": "Echo es un framework web de Go. Desde la versi\u00f3n 4.15.0 hasta las versiones anteriores a la 4.16.1 y a la 5.4.1, el middleware Proxy de Echo puede retener un manejador, copiar goroutines y conexiones de red despu\u00e9s de que un cliente WebSocket se desconecte cuando el origen (upstream) mantiene su conexi\u00f3n abierta. El proxy sin procesar espera en ambas direcciones de copia sin cerrar de forma fiable la conexi\u00f3n del par cuando una direcci\u00f3n finaliza, incluso cuando una respuesta de actualizaci\u00f3n rechazada utiliza el keep-alive de HTTP. Las conexiones repetidas pueden acumular recursos y causar una denegaci\u00f3n de servicio, dependiendo de la accesibilidad de la ruta del proxy, el comportamiento del origen (upstream) y los plazos de conexi\u00f3n. Este problema se ha corregido en las versiones 4.16.1 y 5.4.1."}], "id": "CVE-2026-118262", "lastModified": "2026-11-04T23:10:00.223", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118262", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T13:24:40.679951Z", "version": "2.0.3"}}]}, "published": "2026-10-28T19:17:30.950", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/releases/tag/v4.16.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/releases/tag/v5.4.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-772"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/labstack/echo: echo: Denial of Service (DoS) via unclosed WebSocket proxy connections", "id": "2563105", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563105"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.", "A flaw was found in Echo's Proxy middleware. When handling WebSocket connections, the proxy fails to reliably close upstream network connections and terminate background processes after a client disconnects. A remote attacker can exploit this flaw by repeatedly opening and dropping connections, leading to resource exhaustion and a Denial of Service (DoS)."], "name": "CVE-2026-118262", "public_date": "2026-10-28T19:00:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118262\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118262\nhttps://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec\nhttps://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f\nhttps://github.com/labstack/echo/releases/tag/v4.16.1\nhttps://github.com/labstack/echo/releases/tag/v5.4.1\nhttps://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5"], "statement": "This vulnerability is rated as Important severity because an unauthenticated remote attacker can exhaust critical system resources\u2014such as file descriptors and memory\u2014leading to an application-wide outage without requiring elevated privileges. Within Red Hat environments, the issue specifically threatens services that embed the Echo framework and expose its reverse proxy middleware configured for WebSocket tunneling. Deployments that do not forward WebSocket traffic or only handle standard HTTP reverse proxying remain unaffected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.15.0,4.16.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "echo", "source": "cna", "vendor": "labstack"}, "product": "echo", "vendor": "labstack"}], "created": "2026-10-28T21:30:16.373367+00:00", "updated": "2026-10-28T21:44:54.856443+00:00", "vendors": ["labstack", "labstack$PRODUCT$echo"]}