Missing Release of Resource after Effective Lifetime Affecting github.com/labstack/echo/v4/middleware package, versions >=4.15.0 <4.16.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMLABSTACKECHOV4MIDDLEWARE-21691668
- published24 Oct 2026
- disclosed23 Oct 2026
- creditUnknown
Introduced: 23 Oct 2026
New CVE NOT AVAILABLE CWE-772 (opens in a new tab)How to fix?
Upgrade github.com/labstack/echo/v4/middleware to version 4.16.1 or higher.
Overview
github.com/labstack/echo/v4/middleware is a middleware package for echo.
Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the Proxy middleware. An attacker can exhaust system resources by repeatedly establishing WebSocket connections that are not properly closed after client disconnection, causing accumulation of handlers, goroutines, and network connections if the upstream keeps its connection open. This can be triggered, for example, by rejected upgrade responses with HTTP keep-alive.
Workaround
This vulnerability can be mitigated by disabling WebSocket proxy routes until upgrading, or by applying bounded connection lifetimes and resource limits at the frontend and upstream.