DocumentationSeverity
8.2
High severity
Details
- CVSS score
- 8.2
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Overview
About vulnerability
Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo’s Proxy middleware can retain a handler, copy goroutines, and network connections after a WebSocket client disconnects when the upstream keeps its connection open. The raw proxy waits for both copy directions without reliably closing the peer connection when one direction ends, including when a rejected upgrade response uses HTTP keep-alive. Repeated connections can accumulate resources and cause denial of service, depending on proxy-route accessibility, upstream behavior, and connection deadlines. This issue is fixed in 4.16.1 and 5.4.1.Details
- Affected product:
- Grafana , cockroachdb/errors , getsentry/sentry-go , grafana/e2e , grafana/grafana-app-sdk , grafana/kindsys , grafana/thema , influxdata/flux , influxdata/influxdb , influxdata/influxdb-client-go , labstack/echo , oapi-codegen/oapi-codegen , oapi-codegen/runtime , prometheus/prometheus , thanos-io/objstore
- Affected packages:
- github.com/labstack/echo @ 4.11.4 (+37 more)