Zero Radar
← feed
HighVulnerabilityCVE-2026-118260updated 28 Oct 2026, 19:17 UTC

Echo web framework: optional BodyDump middleware can exhaust server memory

A web app built with the Echo framework can run out of memory and crash if a feature called BodyDump is turned on and an attacker sends very large requests or triggers very large responses. The fix is to upgrade Echo.

Fix availableOfficial, 2 sources
SeverityHighCVSS 8.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesgithub.com/labstack/echo/v4 v4.16.1 (adds BodyDumpConfig.MaxRequestBytes and MaxResponseBytes, default 5 MiB each) · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends large requestsSends oversized bodies to a BodyDump route
  2. 2Echo reads full bodyBodyDump buffers the whole body in memory
  3. 3Memory allocation growsRepeated or concurrent requests stack up
  4. 4Process runs out of memoryServer slows down or crashes
  5. ResultServer denial of service

What happened

In Echo v4 (versions 4.0.0 through 4.16.0), the opt-in BodyDump middleware reads entire request bodies into memory before handlers run and keeps entire response bodies for its callback, with no capture size limit, enabling unbounded memory allocation.

Why it is dangerous: Repeated or concurrent large requests can exhaust process memory, causing denial of service for everyone using the app; response-side exposure is not reduced by request limits.

Are you affected?

You are affected if your application uses github.com/labstack/echo/v4 at version 4.0.0 through 4.16.0 and has BodyDump middleware enabled on any route, especially routes handling large uploads or downloads.

Package / productAffected versionsFixed in
github.com/labstack/echo/v4 · go>= 4.0.0, < 4.16.14.16.1

What to do

  1. Update github.com/labstack/echo/v4 to v4.16.1 or later
  2. If you cannot upgrade yet, disable BodyDump on exposed routes, especially large uploads and downloads
  3. Alternatively, enforce body-size limits before BodyDump and bound the responses your application generates

Timeline

  1. 23 Oct 2026, 20:48 UTC
    Publicly disclosed
  2. 23 Oct 2026, 20:48 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 28 Oct 2026, 19:17 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118260 · GHSA-f48p-c9v4-h7xv
CVSS
8.2 / 10
Disclosed
23 Oct 2026, 20:48 UTC
On Zero Radar
before the radar started
Last change
28 Oct 2026, 19:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Echo web framework: optional BodyDump middleware can exhaust server memory · Zero Radar