Denial of Service Vulnerability in Echo Framework by Labstack

CVE-2026-118261

What is CVE-2026-118261?

The Echo framework, versions 4.0.0 through 4.16.1, has a vulnerability in its opt-in Decompress middleware. This middleware exposes a gzip-decoded request stream without properly limiting its expanded size. As a result, a small compressed request can lead to substantial resource consumption when read or bound by a handler. This situation may cause excessive memory or CPU usage, which opens the door for denial of service attacks, particularly under conditions of repeated or concurrent requests. Although the middleware is not enabled by default, the lack of size restriction on the decoded data can lead to severe impacts on performance. The issue has been addressed in version 4.16.1.

References