CVE-2026-118262

The record

Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.

Affected packages

Related vulnerabilities

• CVE-2026-90870 A missing release of backend receiver sessions in the Ad Hoc Transfer component of… CWE-772
• CVE-2026-112200 P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session… CWE-772
• CVE-2026-115793 P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that… CWE-772
• CVE-2026-114236 storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or… CWE-772
• CVE-2026-59951 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-772
• CVE-2026-104031 A flaw was found in SSSD. CWE-772
• CVE-2026-18149 undici's retry handler can leave an already-exposed response body pending forever. CWE-772
• CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets… CWE-772