UBUNTU-CVE-2026-118260: High severity vulnerability
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echo v4to a version that resolves this vulnerability.Fixed in 4.16.1
Frequently Asked Questions
Which deployments are exposed to this issue?
Only Echo v4 applications that explicitly use the opt-in BodyDump middleware are exposed. BodyDump is not enabled by default; affected versions are 4.0.0 through 4.16.1.
What does an attacker need to do to trigger the memory exhaustion?
An unauthenticated attacker needs network access to a route on which BodyDump is active. They can send large request bodies or cause large responses, with repeated or concurrent requests exhausting process memory.
Do request-size limits fully mitigate the issue?
No. External request limits can reduce exposure from large request bodies, but they do not limit BodyDump's capture of response bodies.
What can be done if upgrading immediately is not possible?
Disable or remove BodyDump middleware from reachable routes. If it must remain enabled, restrict access to those routes and apply request-size limits, recognizing that response-body capture remains unbounded.