Read the docs
TI-2026-82148 Aliases CVE-2026-118261

Unbounded gzip expansion in Echo v4 Decompress middleware

Priority LOW 36CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Echo v4 from 4.0.0 before 4.16.1 has a flaw in its opt-in Decompress middleware, which does not limit the expanded size of gzip-compressed request bodies. A small compressed request can expand into a very large body when a handler reads or binds it, which is an uncontrolled resource consumption issue (CWE-400) related to data amplification (CWE-409). A remote attacker can send such requests to exhaust memory or CPU, and repeated or concurrent requests can cause denial of service. The middleware is not enabled by default.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00372 31st percentileScored 2026-11-07
Fix Fixed echo (labstack): 4.16.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
labstackecho4.0.0 to before 4.16.14.16.1Patch availableCNA
  • echo Vendorlabstack Affected 4.0.0 to before 4.16.1 Fixed in 4.16.1 Patch available CNA

Remediation

Upgrade labstack echo to 4.16.1, which fixes the issue. The sources list no other fixed version for echo.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA echo (labstack) Fixed in 4.16.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118261
  2. 2026-10-29 CISA SSVC decision points changed
  3. 2026-10-29 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Other 3

  • TI-2022-18981 Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the… CVSS 3.1CRITICAL 9.6
  • TI-2026-82185 Path decoding mismatch in Echo middleware.Static exposes static files CVSS 3.1HIGH 7.5
  • TI-2026-40198 Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files CVSS 3.1HIGH 7.5
  • TI-2026-82194 Rate limiter bypass in Echo via spoofed X-Forwarded-For header CVSS 3.1MEDIUM 5.3
  • TI-2026-20833 Echo has a Windows path traversal via backslash in middleware.Static default filesystem CVSS 3.1MEDIUM 5.3
  • TI-2020-18793 Directory traversal on Windows in github.com/labstack/echo/v4 CVSS 3.1MEDIUM 5.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences