GHSA-cxf3-9h37-7rr8
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware.
- github.com/labstack/echo/v4 (Go)
- Critical
- CVSS 9.1
- Fixed version listed
What to do
Fixed version listed
Affected packages
| Package | Affected | Fixed in | Advisory |
|---|---|---|---|
| github.com/labstack/echo/v4 (Go) | >= 4.0.0, < 4.16.1 | 4.16.1 | GHSA-cxf3-9h37-7rr8 |
| github.com/labstack/echo/v5 (Go) | >= 5.0.0, < 5.4.1 | 5.4.1 | GHSA-cxf3-9h37-7rr8 |
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v4.0, scored by GitHub)
Timeline
- GitHub published advisory GHSA-cxf3-9h37-7rr8 (critical). Fixed in 4.16.1, 5.4.1.