CVE-2026-118260: Echo: BodyDump captures request and response bodies without size limits in v4
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.16.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Echo v4 from 4.0.0 through 4.16.1 are exposed only if they enable the opt-in BodyDump middleware on a reachable route. BodyDump is not enabled by default.
What does an attacker need to do to trigger memory exhaustion?
An unauthenticated client must be able to reach a route using BodyDump. They can send large request bodies or cause the route to generate large responses; repeated or concurrent requests can exhaust process memory.
Do request-size limits fully mitigate the issue?
No. External request limits may reduce exposure from oversized request bodies, but they do not limit BodyDump's capture of response bodies.
What should be done if an immediate upgrade is not possible?
Disable BodyDump on reachable routes if possible. If it must remain enabled, restrict access to those routes and reduce the ability for clients to submit large request bodies or induce large responses; request limits alone do not address response capture.
How can I determine whether my application is affected?
Check whether the application uses Echo v4 between 4.0.0 and 4.16.1 and whether BodyDump middleware is enabled for any route reachable by untrusted clients. Upgrading to 4.16.1 fixes the issue.