Description
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
labstack echo
>= 4.15.0, < 4.16.1affected>= 5.0.0, < 5.4.1affected
References
- https://github.com/labstack/echo/security/advisories/GHSA-9969-6676-49h5 ↗
- https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec ↗
- https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f ↗
- https://github.com/labstack/echo/releases/tag/v4.16.1 ↗
- https://github.com/labstack/echo/releases/tag/v5.4.1 ↗