GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

Q: Which deployments are exposed?

Applications using github.com/labstack/echo/v4 that use the BodyDump middleware are the relevant population. The provided information does not establish whether BodyDump is enabled by default.

Q: What would an attacker need to do to trigger the issue?

They would need to cause the application to handle request or response bodies that BodyDump captures. The reported issue is that those captured bodies have no size limits.

Q: How can I identify potentially affected applications?

Review Go dependencies for github.com/labstack/echo/v4 and inspect middleware configuration and code for BodyDump usage. Applications not using that middleware are not identified by the provided information as affected.

Published Nov 5, 2026

Updated

Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

Affected Software

1 affected componentFixes available

go/github.com/labstack/echo/v4>=4.0.0<4.16.1

4.16.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/github.com/labstack/echo/v4 to a version that resolves this vulnerability.
Fixed in 4.16.1

Event History

Nov 5, 2026

Advisory Published

via OSV·10:54 PM

Data Sourced

via OSV·10:54 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed?

Applications using github.com/labstack/echo/v4 that use the BodyDump middleware are the relevant population. The provided information does not establish whether BodyDump is enabled by default.

What would an attacker need to do to trigger the issue?

They would need to cause the application to handle request or response bodies that BodyDump captures. The reported issue is that those captured bodies have no size limits.

How can I identify potentially affected applications?

Review Go dependencies for github.com/labstack/echo/v4 and inspect middleware configuration and code for BodyDump usage. Applications not using that middleware are not identified by the provided information as affected.

GO-2026-6840: Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What would an attacker need to do to trigger the issue?

How can I identify potentially affected applications?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What would an attacker need to do to trigger the issue?

How can I identify potentially affected applications?