Read the docs
TI-2026-82147 Aliases CVE-2026-118260

Unbounded memory use in Echo BodyDump middleware

Priority MEDIUM 42CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Echo, a Go web framework, is affected from 4.0.0 before 4.16.1. Its opt-in BodyDump middleware reads complete request bodies into memory before handlers run and keeps complete response bodies without capture limits, which is an instance of uncontrolled resource consumption (CWE-400). An unauthenticated remote attacker who can reach a route that uses BodyDump can send large bodies or trigger large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00372 31st percentileScored 2026-11-07
Fix Fixed echo (labstack): 4.16.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
labstackecho4.0.0 to before 4.16.14.16.1Patch availableCNA
  • echo Vendorlabstack Affected 4.0.0 to before 4.16.1 Fixed in 4.16.1 Patch available CNA

Remediation

Upgrade Echo v4 to version 4.16.1, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA echo (labstack) Fixed in 4.16.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118260
  2. 2026-10-30 Priority changed: MEDIUM → LOW
  3. 2026-10-30 CISA SSVC decision points changed
  4. 2026-10-30 Priority changed: LOW → MEDIUM
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Other 3

  • TI-2022-18981 Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the… CVSS 3.1CRITICAL 9.6
  • TI-2026-82185 Path decoding mismatch in Echo middleware.Static exposes static files CVSS 3.1HIGH 7.5
  • TI-2026-40198 Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files CVSS 3.1HIGH 7.5
  • TI-2026-82194 Rate limiter bypass in Echo via spoofed X-Forwarded-For header CVSS 3.1MEDIUM 5.3
  • TI-2026-20833 Echo has a Windows path traversal via backslash in middleware.Static default filesystem CVSS 3.1MEDIUM 5.3
  • TI-2020-18793 Directory traversal on Windows in github.com/labstack/echo/v4 CVSS 3.1MEDIUM 5.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences