Echo: WebSocket proxy retains connections and handlers after client disconnect
Summary
Echo is a Go web framework. Its Proxy middleware can keep handlers, goroutines and network connections open after a WebSocket client disconnects, if the upstream server keeps its connection open. Repeated connections can accumulate these resources and exhaust the server, which leads to a denial of service. The impact depends on how reachable the proxy route is, the upstream behaviour and the configured connection deadlines.
Affected
- Echo v4 from 4.15.0 before 4.16.1
- Echo v5 from 5.0.0 before 5.4.1
Fixed in
- Echo v4: 4.16.1 or later
- Echo v5: 5.4.1 or later
Workaround
- Disable WebSocket proxy routes until the upgrade is done.
- Alternatively, apply bounded connection lifetimes and resource limits at the frontend and upstream.
- Server idle timeouts alone may not cover hijacked WebSocket connections.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV.
- Public proof of concept: Unknown.
Our recommendation
- Check whether Go services import github.com/labstack/echo/v4 or /v5 and use the Proxy middleware with WebSocket routes.
- Upgrade to Echo 4.16.1 or 5.4.1 or later and verify that the module graph resolves to a fixed version.
- If you cannot upgrade now, disable WebSocket proxy routes or apply the workarounds.
- Prioritise internet-facing applications that proxy WebSockets; internal-only or non-WebSocket use is lower risk.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-9969-6676-49h5 github.com
- Echo release v4.16.1 github.com
- Echo release v5.4.1 github.com
- Fix commit v4 (3fb0ba7) github.com
- Fix commit v5 (1855061) github.com
- OSV GHSA-9969-6676-49h5 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:45.
Original description (NVD)
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.
NVD references (5)
- https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec
- https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f
- https://github.com/labstack/echo/releases/tag/v4.16.1
- https://github.com/labstack/echo/releases/tag/v5.4.1
- https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.