Echo WebSocket proxy resource retention after client disconnect

Severity: high · CVSS 4 · Published 2026-10-23

Echo is a web framework that includes a Proxy middleware for forwarding requests to upstream servers, including WebSocket connections. A flaw in the middleware allows it to retain network connections and handler goroutines after a WebSocket client disconnects if the upstream server keeps its connection open, causing resource exhaustion and denial of service through accumulated dangling connections.

Technologies: github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go), Labstack Echo. Vendors: Go, Labstack.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 4, published 23 October 2026.
Which products and versions are affected?
github.com/labstack/echo/v4 (Go) >= 4.15.0, < 4.16.1, SEMVER:introduced=4.15.0,fixed=4.16.1; github.com/labstack/echo/v5 (Go) >= 5.0.0, < 5.4.1, SEMVER:introduced=5.0.0,fixed=5.4.1; Labstack Echo v4.15.0 through v4.16.0, v5.0.0 through v5.4.0.
Is there a fix for This vulnerability?
Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.1 or later; github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later. Until then: Disable WebSocket proxy routes until upgrading, or apply bounded connection lifetimes and resource limits at the frontend and upstream. Note that server idle timeouts alone may not cover hijacked WebSocket connections.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-23"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/labstack/echo/v4 (Go): upgrade to 4.16.1 or later
    go get github.com/labstack/echo/v4@v4.16.1
  • github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later
    go get github.com/labstack/echo/v5@v5.4.1

Disable WebSocket proxy routes until upgrading, or apply bounded connection lifetimes and resource limits at the frontend and upstream. Note that server idle timeouts alone may not cover hijacked WebSocket connections.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-23"}]

Technical details

Echo's Proxy middleware has a resource-retention vulnerability (CWE-772) in its WebSocket handling. When a client disconnects, the raw proxy does not reliably close both directions of the connection tunnel if the upstream server remains connected, particularly with HTTP keep-alive rejection responses. This allows handlers, goroutines, and network connections to accumulate across repeated connections. The attack vector is network-based with no authentication required; an attacker can trigger the issue by establishing and disconnecting WebSocket proxy connections repeatedly.

Affected products

  • labstack echo v4.15.0 through v4.16.0, v5.0.0 through v5.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.