CVE-2026-118261: Echo: Decompress permits unbounded gzip expansion in v4
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 4.16.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Echo v4 from 4.0.0 through 4.16.0 are exposed only if they have enabled the opt-in Decompress middleware. The middleware is not enabled by default.
What does an attacker need to do to trigger the denial of service?
An attacker can send a small gzip-compressed request that expands into a very large decoded body when an application handler reads or binds the request. Repeated or concurrent requests can consume excessive memory or CPU.
Does a compressed request-size limit mitigate the issue?
No. Limiting only the compressed request size does not limit the size of the gzip-decoded request body.
What version fixes the issue?
The issue is fixed in Echo v4.16.1.