Read the docs
TI-2026-82150 Aliases CVE-2026-118263

Echo BodyDump middleware discards BodyLimit overflow errors

Priority LOW 34CWE-252Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Echo, a Go web framework, is affected from 5.0.0 before 5.4.1 in Echo v5. The BodyDump middleware drains the remaining request body while ignoring read errors (CWE-252), so a BodyLimit overflow can be discarded. A remote attacker can send an HTTP/1.1 chunked request that exceeds the configured limit, and the truncated body is processed successfully. Known-length requests rejected before BodyDump runs are unaffected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Fix Fixed echo (labstack): 5.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
labstackecho5.0.0 to before 5.4.15.4.1Patch availableCNA
  • echo Vendorlabstack Affected 5.0.0 to before 5.4.1 Fixed in 5.4.1 Patch available CNA

Remediation

Update labstack Echo v5 to version 5.4.1, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA echo (labstack) Fixed in 5.4.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118263
  2. 2026-10-30 Priority changed: MEDIUM → LOW
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2022-18981 Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the… CVSS 3.1CRITICAL 9.6
  • TI-2026-82185 Path decoding mismatch in Echo middleware.Static exposes static files CVSS 3.1HIGH 7.5
  • TI-2026-40198 Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files CVSS 3.1HIGH 7.5
  • TI-2026-82194 Rate limiter bypass in Echo via spoofed X-Forwarded-For header CVSS 3.1MEDIUM 5.3
  • TI-2026-20833 Echo has a Windows path traversal via backslash in middleware.Static default filesystem CVSS 3.1MEDIUM 5.3
  • TI-2020-18793 Directory traversal on Windows in github.com/labstack/echo/v4 CVSS 3.1MEDIUM 5.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences