Is CVE-2026-118262 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118262 being exploited in the wild.

How severe is CVE-2026-118262?

Informational severity, published 28 October 2026.

Which products and versions are affected?

github.com/labstack/echo/v4 (Go) SEMVER:introduced=4.15.0,fixed=4.16.1; github.com/labstack/echo/v5 (Go) SEMVER:introduced=5.0.0,fixed=5.4.1; Labstack Echo 4.15.0 to 4.16.0, 5.4.0.

Is there a fix for CVE-2026-118262?

Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.1 or later; github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118262 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118262?

Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118262: Echo Proxy middleware resource retention and DoS

CVE-2026-118262 · Severity: info · Published 2026-10-28

Echo is a Go web framework used to build HTTP APIs and web applications. The Proxy middleware can retain handlers, goroutines, and network connections after a WebSocket client disconnects if the upstream server keeps its connection open, potentially leading to resource exhaustion and denial of service when many clients connect.

Technologies: github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go), Labstack Echo. Vendors: Go, Labstack.

Quick answers

Is CVE-2026-118262 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118262 being exploited in the wild.
How severe is CVE-2026-118262?: Informational severity, published 28 October 2026.
Which products and versions are affected?: github.com/labstack/echo/v4 (Go) SEMVER:introduced=4.15.0,fixed=4.16.1; github.com/labstack/echo/v5 (Go) SEMVER:introduced=5.0.0,fixed=5.4.1; Labstack Echo 4.15.0 to 4.16.0, 5.4.0.
Is there a fix for CVE-2026-118262?: Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.1 or later; github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118262 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118262?: Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/labstack/echo/v4 (Go): upgrade to 4.16.1 or later
```
go get github.com/labstack/echo/v4@v4.16.1
```
github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later
```
go get github.com/labstack/echo/v5@v5.4.1
```

Technical details

Echo's Proxy middleware fails to reliably close peer connections when one direction of a bidirectional copy ends, particularly in WebSocket scenarios where an upstream server ignores client disconnection. The raw proxy waits for both copy directions without properly closing connections after rejected upgrade responses with HTTP keep-alive enabled, allowing resource accumulation. This is a protocol-handling defect in the middleware component affecting versions 4.15.0–4.16.0 and 5.4.0.

Affected products

labstack Echo 4.15.0 to 4.16.0, 5.4.0

Identifiers

CVE-2026-118262
GHSA-9969-6676-49h5
GO-2026-6838

Timeline

2026-10-28: disclosed
2026-10-22: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.