# labstack

Published articles for labstack.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## CVE-2026-118264 - Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

DevFeed: [CVE-2026-118264 - Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls](<https://devfeed.tech/articles/cve-2026-118264-echo-rejected-websocket-upgrades-can-bypass-echo-route-level-access-controls-105485.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-118264>)

Author: CVEFEED.io; github.com

Published: 2026-10-28T19:17:31Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [Access Control](<https://devfeed.tech/topics/access-control.md>), [WebSocket](<https://devfeed.tech/topics/websocket.md>), [backend frameworks](<https://devfeed.tech/topics/backend-frameworks.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [access-controls](<https://devfeed.tech/tags/access-controls.md>), [accessible](<https://devfeed.tech/tags/accessible.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [client](<https://devfeed.tech/tags/client.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-118264](<https://devfeed.tech/tags/cve-2026-118264.md>), [echo](<https://devfeed.tech/tags/echo.md>), [fixed](<https://devfeed.tech/tags/fixed.md>), [framework](<https://devfeed.tech/tags/framework.md>), [go](<https://devfeed.tech/tags/go.md>), [http](<https://devfeed.tech/tags/http.md>), [independent](<https://devfeed.tech/tags/independent.md>), [issue](<https://devfeed.tech/tags/issue.md>), [keep](<https://devfeed.tech/tags/keep.md>), [labstack](<https://devfeed.tech/tags/labstack.md>), [route](<https://devfeed.tech/tags/route.md>), [upgrades](<https://devfeed.tech/tags/upgrades.md>), [websocket](<https://devfeed.tech/tags/websocket.md>)

### AI overview

In affected Echo versions from 4.0.0 up to 4.16.1 and 5.4.1, Proxy middleware can select a raw tunnel from a client WebSocket upgrade request before confirming the upstream accepted it. If the upstream responds with an ordinary keep-alive response, later HTTP requests on that connection go directly to the upstream, bypassing Echo routing and route-level middleware. This can evade authentication or authorization enforced only by Echo when the proxy route is accessible, the upstream cooperates by rejecting the upgrade this way, and the target has no independent authorization. The issue is fixed in Echo 4.16.1 and 5.4.1.

### Source excerpt

CVE ID :CVE-2026-118264 Published : Oct. 28, 2026, 7:17 p.m. | 2 hours ago Description :Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1. Severity: 9.1 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

## CVE-2026-118260 - Echo: BodyDump captures request and response bodies without size limits in v4

DevFeed: [CVE-2026-118260 - Echo: BodyDump captures request and response bodies without size limits in v4](<https://devfeed.tech/articles/cve-2026-118260-echo-bodydump-captures-request-and-response-bodies-without-size-limits-in-v4-105482.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-118260>)

Author: CVEFEED.io; github.com

Published: 2026-10-28T19:17:30Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [cve remediation](<https://devfeed.tech/topics/cve-remediation.md>), [API Logging](<https://devfeed.tech/topics/api-logging.md>), [CVSS v4.0](<https://devfeed.tech/topics/cvss-v4-0.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [callback](<https://devfeed.tech/tags/callback.md>), [capture](<https://devfeed.tech/tags/capture.md>), [client](<https://devfeed.tech/tags/client.md>), [concurrent](<https://devfeed.tech/tags/concurrent.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-118260](<https://devfeed.tech/tags/cve-2026-118260.md>), [dump](<https://devfeed.tech/tags/dump.md>), [echo](<https://devfeed.tech/tags/echo.md>), [fixed](<https://devfeed.tech/tags/fixed.md>), [framework](<https://devfeed.tech/tags/framework.md>), [go](<https://devfeed.tech/tags/go.md>), [labstack](<https://devfeed.tech/tags/labstack.md>), [large](<https://devfeed.tech/tags/large.md>), [limits](<https://devfeed.tech/tags/limits.md>), [memory](<https://devfeed.tech/tags/memory.md>), [middleware](<https://devfeed.tech/tags/middleware.md>), [process](<https://devfeed.tech/tags/process.md>), [reduce](<https://devfeed.tech/tags/reduce.md>), [request](<https://devfeed.tech/tags/request.md>), [size](<https://devfeed.tech/tags/size.md>)

### AI overview

Echo v4 versions 4.0.0 through before 4.16.1 have a memory exhaustion vulnerability in the opt-in BodyDump middleware. It buffers complete request bodies before handlers run and retains complete response bodies for the dump callback, without capture limits. An unauthenticated client reaching a route that uses BodyDump can send large requests or influence large responses, triggering repeated or concurrent allocations that may exhaust process memory. BodyDump is not enabled by default; external request limits may reduce request-side exposure but do not bound response capture. The issue is fixed in 4.16.1.

### Source excerpt

CVE ID :CVE-2026-118260 Published : Oct. 28, 2026, 7:17 p.m. | 2 hours ago Description :Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

## CVE-2026-118262 - Echo: WebSocket proxy can retain connections and handlers after client disconnect

DevFeed: [CVE-2026-118262 - Echo: WebSocket proxy can retain connections and handlers after client disconnect](<https://devfeed.tech/articles/cve-2026-118262-echo-websocket-proxy-can-retain-connections-and-handlers-after-client-disconnect-105484.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-118262>)

Author: CVEFEED.io; github.com

Published: 2026-10-28T19:17:30Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [WebSocket](<https://devfeed.tech/topics/websocket.md>), [rate-limiting](<https://devfeed.tech/topics/rate-limiting.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [cve-2026-118262](<https://devfeed.tech/tags/cve-2026-118262.md>), [denial-of-service](<https://devfeed.tech/tags/denial-of-service.md>), [echo](<https://devfeed.tech/tags/echo.md>), [fixed](<https://devfeed.tech/tags/fixed.md>), [framework](<https://devfeed.tech/tags/framework.md>), [go](<https://devfeed.tech/tags/go.md>), [goroutines](<https://devfeed.tech/tags/goroutines.md>), [handler](<https://devfeed.tech/tags/handler.md>), [http](<https://devfeed.tech/tags/http.md>), [labstack](<https://devfeed.tech/tags/labstack.md>), [middleware](<https://devfeed.tech/tags/middleware.md>), [network](<https://devfeed.tech/tags/network.md>), [peer](<https://devfeed.tech/tags/peer.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [websocket](<https://devfeed.tech/tags/websocket.md>)

### AI overview

Echo versions 4.15.0 through before 4.16.1, and 5.4.1, can retain handlers, copy goroutines, and network connections after a WebSocket client disconnects if the upstream keeps its connection open. The raw proxy waits for both data-copy directions and may not close the peer connection when one direction ends; this can also occur with an HTTP keep-alive response that rejects an upgrade. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. The issue is fixed in Echo 4.16.1 and 5.4.1.

### Source excerpt

CVE ID :CVE-2026-118262 Published : Oct. 28, 2026, 7:17 p.m. | 2 hours ago Description :Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...