CVE-2026-118264criticalCWE-444CWE-863

CVE-2026-118264: falha crítica em labstack echo

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar echo+ Monitorar github.com/labstack/echo/v4

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.4%
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
labstack · echo
CVEs relacionadas — labstack echo

No mesmo produto, das mais perigosas para as menos.

CVE-2026-55677HIGHEcho: Encoded slash (%2F) bypasses route-level protection and exposes static filesEPSS 0.5%CVE-2026-118653MEDIUMEcho: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default ConfigurationEPSS 0.4%CVE-2026-118650HIGHEcho: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathEPSS 0.4%CVE-2026-118263MEDIUMEcho: BodyDump can discard BodyLimit overflow errors for unknown-length requestsEPSS 0.4%CVE-2026-25766MEDIUMEcho has a Windows path traversal via backslash in middleware.Static default filesystemEPSS 0.4%CVE-2026-118261HIGHEcho: Decompress permits unbounded gzip expansion in v4EPSS 0.4%