{"affected":[{"product":"echo","source":"CNA: GitHub_M","vendor":"labstack","versions":[{"status":"affected","version":">= 4.15.0, < 4.16.1"},{"status":"affected","version":">= 5.0.0, < 5.4.1"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v4","product":"github.com/labstack/echo/v4","source":"OSV GHSA-9969-6676-49h5","vendor":"","versions":[{"events":[{"introduced":"4.15.0"},{"fixed":"4.16.1"}],"lessThan":"4.16.1","status":"affected","version":"4.15.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v5","product":"github.com/labstack/echo/v5","source":"OSV GHSA-9969-6676-49h5","vendor":"","versions":[{"events":[{"introduced":"5.0.0"},{"fixed":"5.4.1"}],"lessThan":"5.4.1","status":"affected","version":"5.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-118262","cwes":["CWE-772"],"description":"Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.","epss":{"date":"2026-11-02","percentile":0.2292,"score":0.00302},"exploits":[],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793712292129,"publishedAt":1793214012315,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v4.16.1"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v5.4.1"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-9969-6676-49h5"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-9969-6676-49h5"}],"remediation":[{"kind":"fix","source":"OSV GHSA-9969-6676-49h5","text":"github.com/labstack/echo/v4 (Go): OSV reports a fixed version 4.16.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-9969-6676-49h5"},{"kind":"fix","source":"OSV GHSA-9969-6676-49h5","text":"github.com/labstack/echo/v5 (Go): OSV reports a fixed version 5.4.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-9969-6676-49h5"}],"revision":"05f21d10ea79e4fc65b8d42efa9886fcae58fc76ce8b7322de90df357909b16a","sources":[{"modifiedAt":1793712292129,"name":"CNA: GitHub_M","retrievedAt":1793714942778,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118262"},{"modifiedAt":1793214903285,"name":"OSV / GitHub Security Advisories","retrievedAt":1793714943315,"url":"https://osv.dev/vulnerability/GHSA-9969-6676-49h5"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793714966142,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118262"}],"ssvc":{"assessedAt":1793712280679,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Echo: WebSocket proxy can retain connections and handlers after client disconnect","updatedAt":1793714966142}