Echo: BodyDump captures request and response bodies without size limits in v4
Only Echo v4 versions 4.0.0 through 4.16.0 that use the opt-in BodyDump middleware on a route are affected. The fix is in 4.16.1.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 4.16.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Echo, a Go web framework, is affected when its optional BodyDump middleware is enabled, since it stores entire request and response bodies in memory without size limits. An unauthenticated attacker who can reach such a route could send large or oversized responses to exhaust the server's memory and crash or destabilize the application.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- labstack echo
From 4.0.0 · fixed in 4.16.1
- github.com/labstack/echo/v4Go
From 4.0.0 · fixed in 4.16.1
References 3
GitHub · labstack/echo
Questions about CVE-2026-118260
What does this mean?
BodyDump, an opt-in Echo v4 middleware, reads complete request bodies into memory with no size limit. Repeated or concurrent requests can exhaust process memory and cause denial of service.Source: github.com
Am I affected, and how do I check?
Echo v4 versions 4.0.0 through 4.16.0 are affected, and only where the BodyDump middleware is used on a route. Check the github.com/labstack/echo/v4 version in go.mod and whether BodyDump is registered on any route.Source: github.com
What should I do about it?
Upgrade Echo v4 to version 4.16.1. Until then, disable BodyDump on exposed routes, particularly those handling large uploads and downloads.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data