DEBIAN-CVE-2026-118260: High severity debian/golang-github-labstack-echo vulnerability

Published Oct 28, 2026

Updated

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.

Affected Software

3 affected components

debian/golang-github-labstack-echo*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Echo v4 to a version that resolves this vulnerability.
Fixed in 4.16.1

Event History

Oct 28, 2026

CVE Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Are applications using Echo affected by default?

No. The vulnerable BodyDump middleware is opt-in and is not enabled by default. Exposure requires a route that uses BodyDump.

Who can exploit this issue?

An unauthenticated client can exploit it if they can reach a route using BodyDump. They can send large request bodies or trigger large responses, causing memory exhaustion through repeated or concurrent allocations.

Do external request-size limits fully mitigate the issue?

No. External request limits may reduce exposure from large request bodies, but they do not limit response-body capture by BodyDump. Large responses can still be retained for the dump callback.

What can be done before upgrading?

Disable BodyDump on reachable routes or otherwise prevent untrusted clients from reaching routes where it is enabled. If BodyDump must remain in use, limiting request sizes can reduce only the request-side risk.

Which versions are affected and fixed?

Echo v4 versions from 4.0.0 until 4.16.1 are affected. The issue is fixed in version 4.16.1.

DEBIAN-CVE-2026-118260: High severity debian/golang-github-labstack-echo vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Are applications using Echo affected by default?

Who can exploit this issue?

Do external request-size limits fully mitigate the issue?

What can be done before upgrading?

Which versions are affected and fixed?

Company

Resources

Contact

Frequently Asked Questions

Are applications using Echo affected by default?

Who can exploit this issue?

Do external request-size limits fully mitigate the issue?

What can be done before upgrading?

Which versions are affected and fixed?