Zero Radar
← feed
HighVulnerabilityCVE-2026-118261updated 28 Oct 2026, 19:17 UTC

Echo web framework can be overloaded by oversized compressed requests

A small compressed request sent to a Go web app using the Echo framework can unpack into a huge amount of data. This can use up the server's memory or processing power and crash or slow it down.

Fix availableOfficial, 2 sources
SeverityHighCVSS 8.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesgithub.com/labstack/echo/v4 4.16.1 (adds DecompressConfig.MaxDecompressedSize, default 100 MiB) · since 25 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestSmall gzip-compressed request body
  2. 2Echo decompressesDecompress middleware has no expanded size limit
  3. 3Handler reads bodyBind or read expands it to a huge size
  4. 4Resources exhaustedMemory or CPU spikes under repeated requests
  5. ResultApplication becomes unavailable (denial of service)

What happened

In Echo v4's opt-in Decompress middleware, the gzip-decoded request stream is not limited in expanded size, so a small compressed body can produce a very large decoded body when read or bound by a handler.

Why it is dangerous: Repeated or concurrent requests can exhaust memory or CPU, causing denial of service for the whole application. Any service that enables gzip request decompression on exposed routes is at risk.

Are you affected?

You are affected if your app uses github.com/labstack/echo/v4 version 4.0.0 through 4.16.0 and enables the Decompress middleware on routes that accept request bodies.

Package / productAffected versionsFixed in
github.com/labstack/echo/v4 · go>= 4.0.0, < 4.16.14.16.1

What to do

  1. Update github.com/labstack/echo/v4 to v4.16.1 or later
  2. If you cannot update now, disable gzip request decompression on exposed routes
  3. Or place BodyLimit after Decompress so the limit applies to decoded bytes
  4. Apply request deadlines and concurrency limits as well

Timeline

  1. 23 Oct 2026, 20:49 UTC
    Publicly disclosed
  2. 23 Oct 2026, 20:49 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 28 Oct 2026, 19:17 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118261 · GHSA-h7wr-284f-5qvc
CVSS
8.2 / 10
Disclosed
23 Oct 2026, 20:49 UTC
On Zero Radar
before the radar started
Last change
28 Oct 2026, 19:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Echo web framework can be overloaded by oversized compressed requests · Zero Radar