Echo: WebSocket proxy can retain connections and handlers after client disconnect

影響: go:github.com/labstack/echo/v4 >= 4.15.0, < 4.16.1 → 4.16.1, go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1

Echo's Proxy middleware could retain a handler, copy goroutines and network connections after a WebSocket client disconnected if the upstream kept its connection open. The raw proxy waited for both copy directions to finish without reliably closing the other connection when one direction ended. Rejected upgrade responses with HTTP keep-alive were one way to trigger this behavior. Repeated connections can accumulate resources and cause denial of service. The impact depends on the proxy route's a…

在 GitHub Advisory Database 阅读

2026/10/24 05:50，GitHub Advisory Database 发布了“Echo: WebSocket proxy can retain connections and handlers after client disconnect”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Go、GitHub。