Homepage

Missing Release of Resource after Effective Lifetime Affecting golang-github-labstack-echo package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-GOLANGGITHUBLABSTACKECHO-21781522
  • published29 Oct 2026
  • disclosed28 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 28 Oct 2026

NewCVE-2026-118262  (opens in a new tab)
CWE-772  (opens in a new tab)

How to fix?

There is no fixed version for Debian:unstable golang-github-labstack-echo.

NVD Description

Note: Versions mentioned in the description apply only to the upstream golang-github-labstack-echo package and not the golang-github-labstack-echo package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.