Echo: WebSocket proxy can retain connections and handlers after client disconnect

影響: go:github.com/labstack/echo/v4 >= 4.15.0, < 4.16.1 → 4.16.1, go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1

Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior. Repeated connections can accumulate resources and cause denial of service. The impact depends on the proxy route's a…

Read on GitHub Advisory Database

On 10/24/2026, 05:50 AM, GitHub Advisory Database published "Echo: WebSocket proxy can retain connections and handlers after client disconnect" (type: Advisory). Severity is "High" (high). Related technologies: Go, GitHub.