# Echo WebSocket proxy resource retention after client disconnect

Source: https://junglewise.ai/threats/echo-websocket-proxy-can-retain-connections-and-handlers-after-client-5418048e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-24  
License: CC BY 4.0 with a link back

Severity: high · CVSS 4 · Published 2026-10-23

Echo is a web framework that includes a Proxy middleware for forwarding requests to upstream servers, including WebSocket connections. A flaw in the middleware allows it to retain network connections and handler goroutines after a WebSocket client disconnects if the upstream server keeps its connection open, causing resource exhaustion and denial of service through accumulated dangling connections.

Technologies: [github.com/labstack/echo/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-labstack-echo-v4), [github.com/labstack/echo/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-labstack-echo-v5), [Labstack Echo](https://junglewise.ai/threats/technologies/labstack-echo). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Labstack](https://junglewise.ai/threats/vendors/labstack).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 4, published 23 October 2026.

**Which products and versions are affected?** github.com/labstack/echo/v4 (Go) >= 4.15.0, < 4.16.1, SEMVER:introduced=4.15.0,fixed=4.16.1; github.com/labstack/echo/v5 (Go) >= 5.0.0, < 5.4.1, SEMVER:introduced=5.0.0,fixed=5.4.1; Labstack Echo v4.15.0 through v4.16.0, v5.0.0 through v5.4.0.

**Is there a fix for This vulnerability?** Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.1 or later; github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later. Until then: Disable WebSocket proxy routes until upgrading, or apply bounded connection lifetimes and resource limits at the frontend and upstream. Note that server idle timeouts alone may not cover hijacked WebSocket connections.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-23"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run github.com/labstack/echo/v4 (Go), github.com/labstack/echo/v5 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/labstack/echo/v4 (Go): upgrade to 4.16.1 or later

  ```sh
  go get github.com/labstack/echo/v4@v4.16.1
  ```

- github.com/labstack/echo/v5 (Go): upgrade to 5.4.1 or later

  ```sh
  go get github.com/labstack/echo/v5@v5.4.1
  ```


Disable WebSocket proxy routes until upgrading, or apply bounded connection lifetimes and resource limits at the frontend and upstream. Note that server idle timeouts alone may not cover hijacked WebSocket connections.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-23"}]

## Technical details

Echo's Proxy middleware has a resource-retention vulnerability (CWE-772) in its WebSocket handling. When a client disconnects, the raw proxy does not reliably close both directions of the connection tunnel if the upstream server remains connected, particularly with HTTP keep-alive rejection responses. This allows handlers, goroutines, and network connections to accumulate across repeated connections. The attack vector is network-based with no authentication required; an attacker can trigger the issue by establishing and disconnecting WebSocket proxy connections repeatedly.

## Affected products

- labstack echo v4.15.0 through v4.16.0, v5.0.0 through v5.4.0

## References

- [https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5](https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5)
- [https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec](https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec)

## Related threats

- [Echo web framework arbitrary URI scheme redirect](https://junglewise.ai/threats/cve-2026-118658-echo-is-a-go-web-framework-prior-to-4-15-2-and-5-1-1-context)
- [Echo Go web framework scheme header spoofing and HSTS bypass](https://junglewise.ai/threats/cve-2026-118657-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-context)
- [Echo open redirect in sanitizeURI with trailing slash redirect](https://junglewise.ai/threats/cve-2026-118656-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-sanitizeuri)
- [Echo path traversal via double URL encoding in Static middleware](https://junglewise.ai/threats/cve-2026-118655-echo-is-a-go-web-framework-prior-to-4-15-3-and-5-2-0-middleware)
- [Echo path traversal in static file handlers via dot segment normalization](https://junglewise.ai/threats/cve-2026-118654-echo-is-a-go-web-framework-prior-to-4-16-0-and-5-4-0-echo-s)