CVE-2026-118264

The record

Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.

Affected packages

Related vulnerabilities

• CVE-2026-55613 uhttpd is a small HTTP server. CWE-444
• CVE-2026-55614 uhttpd is a small HTTP server. CWE-444
• CVE-2026-55612 uhttpd is a small HTTP server. CWE-444
• CVE-2026-116127 Starlet versions before 0.33 for Perl send a body in responses to HEAD requests… CWE-444
• CVE-2026-91920 A flaw was found in the ChunkReader component of the Undertow web server, which is used… CWE-444
• CVE-2026-103995 Response body and chunk parsing would handle non-hex or negative integers incorrectly… CWE-444
• CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests… CWE-444
• CVE-2026-115877 Twisted is an event-based framework for internet applications, supporting Python 3.6+. CWE-444