{"id":"GO-2026-6839","summary":"Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo","details":"Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls in github.com/labstack/echo","aliases":["CVE-2026-118264","GHSA-cxf3-9h37-7rr8"],"modified":"2026-11-05T23:26:10.984049228Z","published":"2026-11-05T22:54:11Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6839"},"references":[{"type":"ADVISORY","url":"https://github.com/labstack/echo/security/advisories/GHSA-cxf3-9h37-7rr8"},{"type":"FIX","url":"https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"},{"type":"FIX","url":"https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v4.16.1"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v5.4.1"}],"affected":[{"package":{"name":"github.com/labstack/echo/v4","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.16.1"}]}],"ecosystem_specific":{"imports":[{"symbols":["BodyDump","BodyDumpWithConfig","Decompress","DecompressWithConfig","Proxy","ProxyWithConfig","proxyHTTP","proxyRaw"],"path":"github.com/labstack/echo/v4/middleware"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6839.json"}},{"package":{"name":"github.com/labstack/echo/v5","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v5"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.4.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/labstack/echo/v5/middleware","symbols":["AddTrailingSlash","AddTrailingSlashWithConfig","BasicAuth","BasicAuthWithConfig","BodyDump","BodyDumpConfig.ToMiddleware","BodyDumpWithConfig","BodyLimit","BodyLimitWithConfig","CORS","CORSConfig.ToMiddleware","CORSWithConfig","CSRF","CSRFConfig.ToMiddleware","CSRFWithConfig","ContextTimeout","ContextTimeoutWithConfig","CreateExtractors","Decompress","DecompressWithConfig","Gzip","GzipWithConfig","HTTPSNonWWWRedirect","HTTPSNonWWWRedirectWithConfig","HTTPSRedirect","HTTPSRedirectWithConfig","HTTPSWWWRedirect","HTTPSWWWRedirectWithConfig","KeyAuth","KeyAuthConfig.ToMiddleware","KeyAuthWithConfig","MethodOverride","MethodOverrideWithConfig","NonWWWRedirect","NonWWWRedirectWithConfig","PanicStackError.Error","Proxy","ProxyConfig.ToMiddleware","ProxyWithConfig","RateLimiter","RateLimiterMemoryStore.AllowContext","RateLimiterWithConfig","Recover","RecoverWithConfig","RemoveTrailingSlash","RemoveTrailingSlashWithConfig","RequestID","RequestIDWithConfig","RequestLogger","RequestLoggerConfig.ToMiddleware","RequestLoggerWithConfig","Rewrite","RewriteConfig.ToMiddleware","RewriteWithConfig","Secure","SecureConfig.ToMiddleware","SecureWithConfig","Static","StaticConfig.ToMiddleware","StaticWithConfig","WWWRedirect","WWWRedirectWithConfig","bodyDumpResponseWriter.Flush","bodyDumpResponseWriter.Hijack","bodyDumpResponseWriter.Write","bodyDumpResponseWriter.WriteHeader","gzipResponseWriter.Flush","gzipResponseWriter.Hijack","gzipResponseWriter.Write","gzipResponseWriter.WriteHeader","limitedGzipReader.Read","limitedReader.Close","limitedReader.Read","limitedWriter.Write","proxyHTTP","proxyRaw"]},{"path":"github.com/labstack/echo/v5","symbols":["ExtractIPFromRealIPHeader"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6839.json"}}],"schema_version":"1.9.2"}