CVE-2026-118651

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

CVE-2026-118651

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

CVE-2026-118651 Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

CVE-2026-118651 Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

CVE-2026-118651

The Echo Go web framework (versions 4.0.0 through 5.4.0 ) contains a vulnerability where the Proxy middleware forwards an attacker-supplied X-Real-IP header to upstream services by default. This occurs when Echo.IPExtractor is not configured, allowing a remote client to spoof their client address...

EUVD-2026-112406

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

CVE-2026-118264

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later...

CVE-2026-118262

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably...

CVE-2026-118264 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later...

EUVD-2026-112396

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later...

CVE-2026-118264 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later...

CVE-2026-118264

The Echo Go web framework (versions 4.0.0 through 4.16.0 and 5.0.0 through 5.4.0 ) contains a vulnerability in its Proxy middleware where it selects a raw tunnel from a client WebSocket upgrade request before verifying the upstream's acceptance. If the upstream rejects the upgrade with a keep-ali...

CVE-2026-118262 Echo: WebSocket proxy can retain connections and handlers after client disconnect

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably...

CVE-2026-118262 Echo: WebSocket proxy can retain connections and handlers after client disconnect

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably...

EUVD-2026-112394

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably...

CVE-2026-118262

The Echo Go web framework (versions v4.15.0 through v4.16.0 and v5.0.0 through v5.4.0 ) contains a resource retention vulnerability in its Proxy middleware . When a WebSocket client disconnects but the upstream maintains its connection, the middleware may fail to reliably close the peer connectio...

CVE-2026-118262: Missing Release of Resource after Effective Lifetime

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably...

CVE-2026-118264: Inconsistent Interpretation of HTTP Requests

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later...

PT-2026-129132

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably...

CVE-2026-118651: Origin Validation Error

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...