CVE-2026-118262
Description
A flaw was found in Echo's Proxy middleware. When handling WebSocket connections, the proxy fails to reliably close upstream network connections and terminate background processes after a client disconnects. A remote attacker can exploit this flaw by repeatedly opening and dropping connections, leading to resource exhaustion and a Denial of Service (DoS).
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker can exhaust critical system resources—such as file descriptors and memory—leading to an application-wide outage without requiring elevated privileges. Within Red Hat environments, the issue specifically threatens services that embed the Echo framework and expose its reverse proxy middleware configured for WebSocket tunneling. Deployments that do not forward WebSocket traffic or only handle standard HTTP reverse proxying remain unaffected.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
