UBUNTU-CVE-2026-118263: Medium severity ubuntu/golang-github-labstack-echo.v2 vulnerability
Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Echoto a version that resolves this vulnerability.Fixed in 5.4.1
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Echo v5 BodyDump middleware together with BodyLimit are affected when BodyDump's capture limit is lower than the configured BodyLimit threshold. The affected versions are 5.0.0 through 5.4.1.
What does an attacker need to do to trigger the behavior?
An unauthenticated attacker can send an HTTP/1.1 chunked request with an unknown body length that exceeds the configured BodyLimit. The condition depends on BodyDump draining the body and discarding the overflow read error.
Are ordinary requests with a declared content length affected?
No. Known-length requests that exceed the limit are rejected before BodyDump runs, so they are unaffected by this behavior.
What is the practical impact?
The oversized chunked request can be truncated to the BodyDump-captured prefix and then processed successfully despite exceeding the original configured body limit. The issue does not establish a general authentication bypass or denial-of-service condition.
What should be changed to remediate the issue?
Update Echo to version 5.4.1, which fixes the issue. If immediate updating is not possible, avoid the affected configuration in which BodyDump's capture limit is below the BodyLimit threshold.