CVE-2026-118263: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests
Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Echo v5 deployments from 5.0.0 through 5.4.0 are affected when BodyDump is used with a capture limit below the configured BodyLimit threshold. The affected request pattern is an HTTP/1.1 request with an unknown body length, such as a chunked request.
What must an attacker do to trigger the behavior?
An attacker must send an unknown-length request whose body exceeds BodyLimit while BodyDump captures only a smaller prefix. BodyDump can then drain the remainder while ignoring the overflow error and replace the request body with the captured prefix.
Are normal requests with a declared content length affected?
No. Known-length requests that exceed the limit are rejected before BodyDump runs.
What should teams do if they cannot patch immediately?
The provided information identifies the risky configuration as using BodyDump with a capture limit below BodyLimit for unknown-length requests. Avoid that combination where possible until updating to the fixed 5.4.1 release.