Go Web Framework Echo Vulnerability in BodyDump Middleware
CVE-2026-118263

6.3MEDIUM

Key Information:

Vendor

Labstack

Status
Echo
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118263?

The Echo web framework has a vulnerability in the BodyDump middleware affecting versions 5.0.0 to 5.4.1. This issue arises when the BodyDump's capture limit is below the BodyLimit threshold, allowing for the potential truncation and improper handling of HTTP/1.1 chunked requests with an unknown-length body. When this occurs, valid requests may unexpectedly surpass the configured limits, leading to a risk of processed data being incorrect. Importantly, this issue does not lead to authentication bypass or denial of service and has been resolved in version 5.4.1.

Affected Version(s)

echo >= 5.0.0, < 5.4.1

References

https://github.com/labstack/echo/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/labstack/echo/pull/3105
x_refsource_MISC
https://github.com/labstack/echo/commit/1855061e572ae9dab...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.