ghsa:GHSA-CXF3-9H37-7RR8: github.com/labstack/echo/v4 >= 4.0.0, < 4.16.1; +1 more affected products

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls. Affected range: >= 4.0.0, < 4.16.1. Fixed version: 4.16.1. Affected range: >= 5.0.0, < 5.4.1. Fixed version: 5.4.1.

Affected technology

github.com/labstack/echo/v4 · >= 4.0.0, < 4.16.1
Vendor not specified by the source

github.com/labstack/echo/v5 · >= 5.0.0, < 5.4.1
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

The source does not specify what an attacker can achieve.

Published 24-Oct-2026 01:47 UTC

Product: github.com/labstack/echo/v4
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-24 01:45:06.114611+00:00 UTC

Stable permalink: https://cybercodered.org/item/adv-ghsa-ghsa-cxf3-9h37-7rr8.html