228 matches found
CVE-2026-118651
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
CVE-2026-118651
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
CVE-2026-118651 Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
EUVD-2026-112406
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
CVE-2026-118651
The Echo Go web framework (versions 4.0.0 through 5.4.0 ) contains a vulnerability where the Proxy middleware forwards an attacker-supplied X-Real-IP header to upstream services by default. This occurs when Echo.IPExtractor is not configured, allowing a remote client to spoof their client address...
CVE-2026-118264
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later...
CVE-2026-118262
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably...
EUVD-2026-112396
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later...
CVE-2026-118264 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later...
CVE-2026-118264
The Echo Go web framework (versions 4.0.0 through 4.16.0 and 5.0.0 through 5.4.0 ) contains a vulnerability in its Proxy middleware where it selects a raw tunnel from a client WebSocket upgrade request before verifying the upstream's acceptance. If the upstream rejects the upgrade with a keep-ali...
EUVD-2026-112394
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably...
CVE-2026-118262 Echo: WebSocket proxy can retain connections and handlers after client disconnect
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably...
CVE-2026-118262
The Echo Go web framework (versions v4.15.0 through v4.16.0 and v5.0.0 through v5.4.0 ) contains a resource retention vulnerability in its Proxy middleware . When a WebSocket client disconnects but the upstream maintains its connection, the middleware may fail to reliably close the peer connectio...
PT-2026-129132
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably...
PT-2026-129167
Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were...
GHSA-CXF3-9H37-7RR8 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Impact Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were...
PT-2026-129134
Name of the Vulnerable Software and Affected Versions Echo versions 4.0.0 through 4.16.0 Echo versions 5.0.0 through 5.4.0 Description The Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying if the configured upstream accepted the upgrade. If the upstrea...