Echo: BodyDump captures request and response bodies without size limits in v4
Impact
Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation.
Source excerpt · OSVDeployments with effective request limits may reduce the request-side exposure; response capture requires separate consideration.
What to do
Upgrade to v4.16.1.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 4.0.0 before 4.16.1Semantic versions | 4.16.1 |
Version evidence: OSV · GHSA-f48p-c9v4-h7xv
View original version evidence (0 explicit versions)
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
labstack · GitHub_M
echo
1 range
labstack · GitHub_M
echo
Compare with this publisher’s ranges. This does not inspect your installation.
affected
>= 4.0.0, < 4.16.1
Other versions: unknown
Original source description
Impact
Echo v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation.
Repeated or concurrent requests can exhaust process memory and cause denial of service. BodyDump is not enabled by default. Deployments with effective request limits may reduce the request-side exposure; response capture requires separate consideration.
Affected versions and patch
Echo v4 versions through v4.16.0 are affected. Upgrade to v4.16.1.
The patch adds BodyDumpConfig.MaxRequestBytes and MaxResponseBytes, each defaulting to 5 MiB when zero. A value of -1 explicitly restores unlimited capture. The complete request remains readable by the handler and the complete response is delivered to the client; only the callback's captured data is bounded. Request close behavior and read errors are preserved.
Workarounds
Disable BodyDump on exposed routes, particularly large uploads and downloads. Alternatively, enforce body-size limits before BodyDump and independently bound the responses that the application generates.
Credits
Reported by @q490107865. The patch also incorporates request-body preservation work from @jakezwang in #3105.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-118260View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changes- CVE · CVE-2026-118260
Observed 2026-10-30T19:39:44.221Z · upstream updated 2026-10-30T19:19:59.727Z
Prioritization updated
before
[]
after
[ { "source": "CISA-ADP", "type": "SSVC", "role": "CISA Coordinator", "timestamp": "2026-10-30T19:19:33.342446Z", "decisions": [ { "name": "Exploitation", "value": "none" }, { "name": "Automatable", "value": "yes" }, { "name": "Technical Impact", "value": "partial" } ] } ]
Large field values are marked as truncated previews. Original source snapshots remain retained.
Showing up to 50 most recent observed changes.