{"id":"GO-2026-6838","summary":"Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo","details":"Echo: WebSocket proxy can retain connections and handlers after client disconnect in github.com/labstack/echo","aliases":["CVE-2026-118262","GHSA-9969-6676-49h5"],"modified":"2026-11-05T23:25:47.132082982Z","published":"2026-11-05T22:54:11Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6838","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5"},{"type":"FIX","url":"https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"},{"type":"FIX","url":"https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v4.16.1"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v5.4.1"}],"affected":[{"package":{"name":"github.com/labstack/echo/v4","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.15.0"},{"fixed":"4.16.1"}]}],"ecosystem_specific":{"imports":[{"symbols":["BodyDump","BodyDumpWithConfig","Decompress","DecompressWithConfig","Proxy","ProxyWithConfig","proxyHTTP","proxyRaw"],"path":"github.com/labstack/echo/v4/middleware"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6838.json"}},{"package":{"name":"github.com/labstack/echo/v5","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.4.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/labstack/echo/v5","symbols":["ExtractIPFromRealIPHeader"]},{"symbols":["AddTrailingSlash","AddTrailingSlashWithConfig","BasicAuth","BasicAuthWithConfig","BodyDump","BodyDumpConfig.ToMiddleware","BodyDumpWithConfig","BodyLimit","BodyLimitWithConfig","CORS","CORSConfig.ToMiddleware","CORSWithConfig","CSRF","CSRFConfig.ToMiddleware","CSRFWithConfig","ContextTimeout","ContextTimeoutWithConfig","CreateExtractors","Decompress","DecompressWithConfig","Gzip","GzipWithConfig","HTTPSNonWWWRedirect","HTTPSNonWWWRedirectWithConfig","HTTPSRedirect","HTTPSRedirectWithConfig","HTTPSWWWRedirect","HTTPSWWWRedirectWithConfig","KeyAuth","KeyAuthConfig.ToMiddleware","KeyAuthWithConfig","MethodOverride","MethodOverrideWithConfig","NonWWWRedirect","NonWWWRedirectWithConfig","PanicStackError.Error","Proxy","ProxyConfig.ToMiddleware","ProxyWithConfig","RateLimiter","RateLimiterMemoryStore.AllowContext","RateLimiterWithConfig","Recover","RecoverWithConfig","RemoveTrailingSlash","RemoveTrailingSlashWithConfig","RequestID","RequestIDWithConfig","RequestLogger","RequestLoggerConfig.ToMiddleware","RequestLoggerWithConfig","Rewrite","RewriteConfig.ToMiddleware","RewriteWithConfig","Secure","SecureConfig.ToMiddleware","SecureWithConfig","Static","StaticConfig.ToMiddleware","StaticWithConfig","WWWRedirect","WWWRedirectWithConfig","bodyDumpResponseWriter.Flush","bodyDumpResponseWriter.Hijack","bodyDumpResponseWriter.Write","bodyDumpResponseWriter.WriteHeader","gzipResponseWriter.Flush","gzipResponseWriter.Hijack","gzipResponseWriter.Write","gzipResponseWriter.WriteHeader","limitedGzipReader.Read","limitedReader.Close","limitedReader.Read","limitedWriter.Write","proxyHTTP","proxyRaw"],"path":"github.com/labstack/echo/v5/middleware"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6838.json"}}],"schema_version":"1.9.2"}