CVE-2026-118263

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118263", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-27T20:13:55.314Z", "datePublished": "2026-10-28T19:01:30.268Z", "dateUpdated": "2026-11-02T20:38:12.788Z"}, "containers": {"cna": {"title": "Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests", "problemTypes": [{"descriptions": [{"cweId": "CWE-252", "lang": "en", "description": "CWE-252: Unchecked Return Value", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/labstack/echo/security/advisories/GHSA-x9ff-22gv-65f4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/labstack/echo/security/advisories/GHSA-x9ff-22gv-65f4"}, {"name": "https://github.com/labstack/echo/pull/3105", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/pull/3105"}, {"name": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"}, {"name": "https://github.com/labstack/echo/releases/tag/v5.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/labstack/echo/releases/tag/v5.4.1"}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"version": ">= 5.0.0, < 5.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T19:01:30.268Z"}, "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1."}], "source": {"advisory": "GHSA-x9ff-22gv-65f4", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T20:38:03.408927Z", "id": "CVE-2026-118263", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T20:38:12.788Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118263", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T20:38:03.408927Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T20:38:08.666Z"}}], "cna": {"title": "Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests", "source": {"advisory": "GHSA-x9ff-22gv-65f4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "labstack", "product": "echo", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.4.1"}]}], "references": [{"url": "https://github.com/labstack/echo/security/advisories/GHSA-x9ff-22gv-65f4", "name": "https://github.com/labstack/echo/security/advisories/GHSA-x9ff-22gv-65f4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/labstack/echo/pull/3105", "name": "https://github.com/labstack/echo/pull/3105", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec", "name": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/labstack/echo/releases/tag/v5.4.1", "name": "https://github.com/labstack/echo/releases/tag/v5.4.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-252", "description": "CWE-252: Unchecked Return Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T19:01:30.268Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118263", "state": "PUBLISHED", "dateUpdated": "2026-11-02T20:38:12.788Z", "dateReserved": "2026-10-27T20:13:55.314Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T19:01:30.268Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "echo", "vendor": "labstack", "versions": [{"status": "affected", "version": ">= 5.0.0, < 5.4.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1."}, {"lang": "es", "value": "Echo es un framework web de Go. Desde la versi\u00f3n 5.0.0 hasta la 5.4.1, el middleware BodyDump de Echo v5 puede descartar un error de desbordamiento de BodyLimit para una solicitud de longitud desconocida cuando el l\u00edmite de captura de BodyDump est\u00e1 por debajo del umbral de BodyLimit. BodyDump vac\u00eda el cuerpo restante ignorando los errores de lectura y lo reemplaza con el prefijo capturado, por lo que una solicitud HTTP/1.1 fragmentada puede ser truncada y procesada con \u00e9xito a pesar de que el cuerpo original excedi\u00f3 el l\u00edmite configurado. Las solicitudes de longitud conocida rechazadas antes de que se ejecute BodyDump no se ven afectadas, y el problema no establece una omisi\u00f3n de autenticaci\u00f3n general ni una denegaci\u00f3n de servicio. Este problema se ha solucionado en la versi\u00f3n 5.4.1."}], "id": "CVE-2026-118263", "lastModified": "2026-11-04T23:10:00.223", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118263", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T20:38:03.408927Z", "version": "2.0.3"}}]}, "published": "2026-10-28T19:17:31.097", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/pull/3105"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/releases/tag/v5.4.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/labstack/echo/security/advisories/GHSA-x9ff-22gv-65f4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Undergoing Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-252"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/labstack/echo: Echo: Request body limit bypass via BodyDump error handling", "id": "2563109", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563109"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-252", "details": ["Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1.", "A flaw was found in Echo's BodyDump middleware. A remote attacker can exploit this vulnerability to bypass configured request body limits and cause the application to process truncated data. When handling requests of unknown length, such as chunked HTTP requests, the middleware discards overflow errors if its capture limit is set lower than the server's body limit. Consequently, the application processes an incomplete request rather than rejecting the oversized payload."], "name": "CVE-2026-118263", "public_date": "2026-10-28T19:01:30Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118263\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118263\nhttps://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec\nhttps://github.com/labstack/echo/pull/3105\nhttps://github.com/labstack/echo/releases/tag/v5.4.1\nhttps://github.com/labstack/echo/security/advisories/GHSA-x9ff-22gv-65f4"], "statement": "This vulnerability is rated as Moderate severity because exploitation requires a specific configuration combining both BodyDump and BodyLimit middlewares where the capture threshold is set below the enforced body limit. Furthermore, the issue only impacts indeterminate-length or chunked HTTP requests, as standard requests with fixed Content-Length headers are rejected before reaching the vulnerable logic. As a result, the flaw allows an attacker to bypass payload size boundaries and force truncation rather than enabling remote code execution, authentication compromise, or denial of service.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "echo", "source": "cna", "vendor": "labstack"}, "product": "echo", "vendor": "labstack"}], "created": "2026-10-28T20:45:15.035753+00:00", "updated": "2026-10-28T20:45:15.662222+00:00", "vendors": ["labstack", "labstack$PRODUCT$echo"]}