Echo: WebSocket proxy can retain connections and handlers after client disconnect

影響: go:github.com/labstack/echo/v4 >= 4.15.0, < 4.16.1 → 4.16.1, go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1

Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior. Repeated connections can accumulate resources and cause denial of service. The impact depends on the proxy route's a…

GitHub Advisory Databaseで読む

2026/10/24 05:50、GitHub Advisory Databaseが「Echo: WebSocket proxy can retain connections and handlers after client disconnect」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Go、GitHub。