{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "incident": {
    "id": "ghsa-cxf3-9h37-7rr8",
    "url": "https://cveboard.org/i/ghsa-cxf3-9h37-7rr8",
    "urlPt": "https://cveboard.org/pt/i/ghsa-cxf3-9h37-7rr8",
    "json": "https://cveboard.org/i/ghsa-cxf3-9h37-7rr8.json",
    "kind": "vuln",
    "live": true,
    "knownExploited": false,
    "severity": "critical",
    "title": "Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls",
    "summary": "Echo's Proxy middleware selected a raw tunnel when the client requested a WebSocket upgrade, before validating whether the configured upstream accepted it. If the upstream returned an ordinary HTTP response and kept the connection alive, subsequent HTTP requests on that connection were forwarded directly to the same upstream without passing through Echo's router or route-specific middleware.",
    "titlePt": "Echo: atualizações de WebSocket rejeitadas podem contornar os controles de acesso ao nível da rota do Echo",
    "summaryPt": "O middleware Proxy do Echo selecionou um túnel bruto quando o cliente solicitou uma atualização do WebSocket, antes de validar se o upstream configurado a aceitou. Se o upstream retornou uma resposta HTTP comum e manteve a conexão ativa, solicitações HTTP subsequentes nessa conexão foram encaminhadas diretamente para o mesmo upstream sem passar pelo roteador do Echo ou pelo middleware específico da rota.",
    "affected": [],
    "omitted": 0,
    "references": [],
    "cwes": [],
    "ssvc": null,
    "fix": "listed",
    "tags": [
      "go"
    ],
    "cves": [],
    "ghsa": "GHSA-cxf3-9h37-7rr8",
    "cvss": {
      "score": 9.1,
      "version": "4.0",
      "by": "GitHub"
    },
    "epss": null,
    "packages": [
      {
        "ecosystem": "go",
        "name": "github.com/labstack/echo/v4",
        "vulnerable": ">= 4.0.0, < 4.16.1",
        "fixed": "4.16.1",
        "advisory": "GHSA-cxf3-9h37-7rr8"
      },
      {
        "ecosystem": "go",
        "name": "github.com/labstack/echo/v5",
        "vulnerable": ">= 5.0.0, < 5.4.1",
        "fixed": "5.4.1",
        "advisory": "GHSA-cxf3-9h37-7rr8"
      }
    ],
    "vendor": null,
    "product": null,
    "kev": null,
    "breach": null,
    "retracted": false,
    "sources": [
      {
        "label": "GitHub Advisory Database",
        "url": "https://github.com/advisories/GHSA-cxf3-9h37-7rr8"
      }
    ],
    "cvePending": false,
    "publishedAt": "2026-10-23T20:49:37.000Z",
    "updatedAt": "2026-10-23T20:49:37.000Z"
  },
  "live": true,
  "events": [
    {
      "id": "ghsa:GHSA-cxf3-9h37-7rr8:ghsa_published:2026-10-23T20:49:37.000Z",
      "incidentId": "ghsa-cxf3-9h37-7rr8",
      "type": "ghsa_published",
      "at": "2026-10-23T20:49:37.000Z",
      "detail": {
        "ghsa": "GHSA-cxf3-9h37-7rr8",
        "severity": "critical",
        "fixed": "4.16.1, 5.4.1"
      }
    }
  ]
}