VULNRABLE / Vulnerability / GHSA-cxf3-9h37-7rr8
GHSA-cxf3-9h37-7rr8
CRITICAL WATCH github.com/labstack/echo/v4 GHSA
Exploit verdict: CVSS 9.5 · no EPSS data
CVSS Score
9.5
Severity
CRITICAL
EPSS
—
Source
GHSA
Summary
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
What this means
GHSA-cxf3-9h37-7rr8 is a critical-severity vulnerability affecting github.com/labstack/echo/v4, rated CVSS 9.5. Published October 23, 2026.
View full advisory at GHSA →