## Echo: WebSocket proxy can retain connections and handlers after client disconnect

- 種別: advisory
- 重大度: high
- 関連技術: go, github
- 公開日時: 2026-10-23T20:50:17.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-9969-6676-49h5)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-9969-6676-49h5

影響: go:github.com/labstack/echo/v4 >= 4.15.0, < 4.16.1 → 4.16.1, go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1
Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior. Repeated connections can accumulate resources and cause denial of service. The impact depends on the proxy route's a…