CVE-2026-118260

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118260", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-27T20:13:55.314Z", "datePublished": "2026-10-28T18:56:56.747Z", "dateUpdated": "2026-10-30T19:19:59.727Z"}, "containers": {"cna": {"title": "Echo: BodyDump captures request and response bodies without size limits in v4", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv"}, {"name": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"}, {"name": "https://github.com/labstack/echo/releases/tag/v4.16.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/releases/tag/v4.16.1"}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"version": ">= 4.0.0, < 4.16.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T18:56:56.747Z"}, "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1."}], "source": {"advisory": "GHSA-f48p-c9v4-h7xv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T19:19:33.342446Z", "id": "CVE-2026-118260", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T19:19:59.727Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118260", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T19:19:33.342446Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T19:19:39.070Z"}}], "cna": {"title": "Echo: BodyDump captures request and response bodies without size limits in v4", "source": {"advisory": "GHSA-f48p-c9v4-h7xv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.16.1"}]}], "references": [{"url": "https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv", "name": "https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f", "name": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/releases/tag/v4.16.1", "name": "https://github.com/labstack/echo/releases/tag/v4.16.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T18:56:56.747Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118260", "state": "PUBLISHED", "dateUpdated": "2026-10-30T19:19:59.727Z", "dateReserved": "2026-10-27T20:13:55.314Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T18:56:56.747Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "echo", "vendor": "labstack", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.16.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1."}, {"lang": "es", "value": "Echo es un framework web de Go. Desde la versi\u00f3n 4.0.0 hasta la 4.16.1, el middleware BodyDump opcional de Echo v4 lee los cuerpos completos de las solicitudes en la memoria antes de que se ejecuten los manejadores y retiene los cuerpos completos de las respuestas para la devoluci\u00f3n de llamada de volcado (dump callback) sin l\u00edmites de captura. Un cliente no autenticado que pueda alcanzar una ruta que utilice BodyDump puede enviar cuerpos grandes o influir en respuestas grandes, causando asignaciones repetidas o concurrentes que agotan la memoria del proceso. BodyDump no est\u00e1 habilitado por defecto, y los l\u00edmites de solicitudes externos pueden reducir la exposici\u00f3n del lado de la solicitud, pero no limitan la captura de respuestas. Este problema est\u00e1 corregido en la versi\u00f3n 4.16.1."}], "id": "CVE-2026-118260", "lastModified": "2026-11-04T23:10:00.223", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118260", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T19:19:33.342446Z", "version": "2.0.3"}}]}, "published": "2026-10-28T19:17:30.663", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/releases/tag/v4.16.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/labstack/echo: echo: Denial of Service via memory exhaustion in BodyDump middleware", "id": "2563102", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563102"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.", "A flaw was found in Echo's BodyDump middleware. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending requests with large bodies or triggering large responses on routes using this middleware. Because the middleware reads and retains complete request and response bodies in memory without size limits, repeated or concurrent requests can exhaust system memory and crash the application process."], "name": "CVE-2026-118260", "public_date": "2026-10-28T18:56:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118260\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118260\nhttps://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f\nhttps://github.com/labstack/echo/releases/tag/v4.16.1\nhttps://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv"], "statement": "Red Hat rates this flaw as Important because an unauthenticated remote attacker can exhaust application memory and crash the service without requiring prior privileges. However, overall exposure is limited because the BodyDump middleware is an opt-in logging feature that is not enabled by default. Applications utilizing the Echo framework are affected only if routes have been explicitly configured to capture request and response streams. Typical deployments that do not register this debugging middleware remain unaffected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.16.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "echo", "source": "cna", "vendor": "labstack"}, "product": "echo", "vendor": "labstack"}], "created": "2026-10-28T20:45:15.036366+00:00", "updated": "2026-10-28T20:45:15.664604+00:00", "vendors": ["labstack", "labstack$PRODUCT$echo"]}