{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incident": {
    "id": "cve-2026-118264",
    "url": "https://cveboard.org/i/cve-2026-118264",
    "urlPt": "https://cveboard.org/pt/i/cve-2026-118264",
    "json": "https://cveboard.org/i/cve-2026-118264.json",
    "kind": "vuln",
    "live": true,
    "knownExploited": false,
    "severity": "critical",
    "title": "Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls",
    "summary": "Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware.",
    "titlePt": "Echo: atualizações de WebSocket rejeitadas podem contornar os controles de acesso de nível de rota do Echo",
    "summaryPt": "O middleware Proxy do Echo selecionou um túnel bruto quando o cliente solicitou uma atualização do WebSocket, antes de validar se o upstream configurado a aceitou. Se o upstream retornou uma resposta HTTP comum e manteve a conexão ativa, solicitações HTTP subsequentes nessa conexão foram encaminhadas diretamente para o mesmo upstream sem passar pelo roteador do Echo ou pelo middleware específico da rota.",
    "affected": [
      {
        "vendor": "labstack",
        "product": "echo",
        "defaultStatus": "unknown",
        "versions": [
          {
            "version": ">= 4.0.0, < 4.16.1",
            "status": "affected",
            "lessThan": null,
            "lessThanOrEqual": null
          },
          {
            "version": ">= 5.0.0, < 5.4.1",
            "status": "affected",
            "lessThan": null,
            "lessThanOrEqual": null
          }
        ],
        "omitted": 0,
        "fixed": []
      }
    ],
    "omitted": 0,
    "references": [],
    "cwes": [
      {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"
      },
      {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      }
    ],
    "ssvc": null,
    "fix": "listed",
    "tags": [
      "labstack",
      "go"
    ],
    "description": "Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive response, later HTTP requests on the connection are sent directly to that upstream without passing through Echo's router or route-specific middleware. This can bypass authentication or authorization enforced only by Echo routes, but requires an accessible proxy route, a cooperating rejected-upgrade response, and a target without independent upstream authorization. This issue is fixed in 4.16.1 and 5.4.1.",
    "descriptionFrom": "cve",
    "descriptionAt": null,
    "summaryFrom": "ghsa",
    "cves": [
      "CVE-2026-118264"
    ],
    "ghsa": "GHSA-cxf3-9h37-7rr8",
    "cvss": {
      "score": 9.1,
      "version": "4.0",
      "by": "GitHub"
    },
    "epss": null,
    "packages": [
      {
        "ecosystem": "go",
        "name": "github.com/labstack/echo/v4",
        "vulnerable": ">= 4.0.0, < 4.16.1",
        "fixed": "4.16.1",
        "advisory": "GHSA-cxf3-9h37-7rr8"
      },
      {
        "ecosystem": "go",
        "name": "github.com/labstack/echo/v5",
        "vulnerable": ">= 5.0.0, < 5.4.1",
        "fixed": "5.4.1",
        "advisory": "GHSA-cxf3-9h37-7rr8"
      }
    ],
    "vendor": "labstack",
    "product": "echo",
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "cve.now",
        "url": "https://cve.now/CVE-2026-118264"
      },
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-cxf3-9h37-7rr8"
      }
    ],
    "cveVersion": 1,
    "cvePending": false,
    "publishedAt": "2026-10-23T20:49:37.000Z",
    "updatedAt": "2026-10-28T19:21:32.000Z"
  },
  "live": true,
  "events": [
    {
      "id": "ghsa:GHSA-cxf3-9h37-7rr8:ghsa_updated:2026-10-28T19:21:32.000Z",
      "incidentId": "cve-2026-118264",
      "type": "ghsa_updated",
      "at": "2026-10-28T19:21:32.000Z",
      "detail": {
        "ghsa": "GHSA-cxf3-9h37-7rr8",
        "severity": "critical",
        "fixed": "4.16.1, 5.4.1"
      }
    },
    {
      "id": "cvenow:CVE-2026-118264:cvenow_discovered:first",
      "incidentId": "cve-2026-118264",
      "type": "cvenow_discovered",
      "at": "2026-10-28T19:03:01.533Z",
      "detail": {}
    },
    {
      "id": "ghsa:GHSA-cxf3-9h37-7rr8:ghsa_published:2026-10-23T20:49:37.000Z",
      "incidentId": "cve-2026-118264",
      "type": "ghsa_published",
      "at": "2026-10-23T20:49:37.000Z",
      "detail": {
        "ghsa": "GHSA-cxf3-9h37-7rr8",
        "severity": "critical",
        "fixed": "4.16.1, 5.4.1"
      }
    }
  ]
}