Memory Exhaustion Vulnerability in Echo Web Framework by Labstack

CVE-2026-118260

What is CVE-2026-118260?

The Echo web framework, specifically versions from 4.0.0 to 4.16.1, has a vulnerability related to its opt-in BodyDump middleware. When BodyDump is active, it reads the entire request body into memory prior to executing any handlers and also retains complete response bodies. This behavior can lead to potential memory exhaustion issues when an unauthenticated client sends large request bodies or manipulates extensive response data. While BodyDump is not enabled by default, the lack of strict constraints on response capture can result in significant memory allocation that depletes system resources. The issue has been addressed in version 4.16.1. For more information, visit the official advisory at GitHub.

References