CVE-2026-118262: 
Wolfi vulnerability analysis and mitigation

CVE-2026-118262 is a resource retention vulnerability in the Proxy middleware of Echo, a Go web framework developed by LabStack. When a WebSocket client disconnects, the middleware can retain handlers, copy goroutines, and network connections if the upstream keeps its connection open, because the raw proxy waits for both copy directions to finish without reliably closing the peer connection when one direction ends. This affects Echo versions >= 4.15.0 and < 4.16.1 (v4 branch) and >= 5.0.0 and < 5.4.1 (v5 branch). The vulnerability was published on October 28, 2026, and carries a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime): the Proxy middleware's raw bidirectional copy loop does not reliably close the upstream connection when the client-side direction terminates, including when a rejected WebSocket upgrade response uses HTTP keep-alive (GitHub Advisory). The regression was introduced by commit e213332 (merged in PR #2852) and affects both the v4 and v5 branches. An unauthenticated attacker can exploit this by repeatedly initiating WebSocket connections — or sending rejected upgrade requests with keep-alive — to a proxy route, causing goroutines and file descriptors to accumulate without being released. The fix replaces the raw proxy with Go's standard HTTP reverse proxy, which properly closes both sides of a WebSocket tunnel when either direction ends, and also handles the case where an upstream reads client EOF but deliberately keeps its side open (Echo v4.16.1 Release, Fix Commit v5).

Successful exploitation causes denial of service through resource exhaustion: handlers, goroutines, and network connections accumulate on the Echo server without being released, degrading or crashing the service over time. There is no confidentiality or integrity impact — the vulnerability is limited to availability (GitHub Advisory). The severity of impact depends on the accessibility of the proxy route, upstream server behavior, and whether connection deadlines are configured; publicly accessible proxy routes with permissive upstreams are most at risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability is exploitable by unauthenticated attackers over the network with no user interaction required, but requires the presence of a WebSocket proxy route and a cooperating (or unresponsive) upstream. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly). No threat actor attribution has been reported.

1. Reconnaissance: Identify an Echo-based application (v4.15.0–v4.16.0 or v5.0.0–v5.4.0) that exposes a WebSocket proxy route, using tools like Shodan, Censys, or manual inspection of HTTP upgrade responses.
2. Initiate WebSocket upgrade: Send an HTTP Upgrade request to the target proxy endpoint (e.g., GET /ws HTTP/1.1 with Upgrade: websocket and Connection: Upgrade headers).
3. Trigger resource retention: Either disconnect the WebSocket client immediately after the upstream accepts the connection (leaving the upstream side open), or send a request that results in a rejected upgrade response with Connection: keep-alive to trigger the half-close bug.
4. Repeat connections: Automate repeated connections (e.g., using a script with gorilla/websocket or websocat) to accumulate unreleased goroutines, handlers, and file descriptors on the server.
5. Achieve denial of service: After sufficient iterations, the server's resource limits (goroutines, file descriptors, memory) are exhausted, causing degraded performance or a crash (GitHub Advisory).

• Network: Unusually high number of persistent TCP connections from a single or rotating set of client IPs to the Echo proxy endpoint; connections that remain in ESTABLISHED or CLOSE_WAIT state long after the client has disconnected.
• Process: Rapidly growing goroutine count in Go runtime metrics (e.g., via /debug/pprof/goroutine); increasing open file descriptor count for the Echo server process (/proc/<pid>/fd).
• Logs: Repeated WebSocket upgrade requests (HTTP 101 or rejected upgrade responses) from the same or rotating source IPs in access logs; absence of corresponding connection close log entries; server-side timeout or out-of-memory errors in application logs.
• System: Elevated memory usage or OOM-killer events on the host running the Echo server; netstat or ss showing a large number of sockets in CLOSE_WAIT state associated with the Echo process (GitHub Advisory).

Upgrade Echo to v4.16.1 (v4 branch) or v5.4.1 (v5 branch), which replace the raw proxy with Go's standard HTTP reverse proxy and ensure both sides of a WebSocket tunnel are closed when either direction ends (Echo v4.16.1 Release, Echo v5.4.1 Release). For systems unable to upgrade immediately, the official advisory recommends disabling WebSocket proxy routes until patching is possible, or applying bounded connection lifetimes and resource limits at the frontend and upstream (GitHub Advisory). Note that server idle timeouts alone may not cover hijacked WebSocket connections; connection limits and monitoring on proxy routes should also be implemented as interim controls.