CVE-2026-118260 in Echo
Summary
by MITRE • 10/28/2026
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Echo web framework for the Go programming language contains a resource exhaustion vulnerability within its opt-in BodyDump middleware component. This flaw affects versions ranging from 4.0.0 through 4.16.1 and stems from an implementation oversight where the middleware fails to enforce size limits on request or response bodies during logging operations. Specifically, when enabled, the BodyDump middleware reads entire HTTP request bodies into memory prior to passing control to application handlers and retains complete response bodies for subsequent callback execution. This design choice creates a significant risk of Denial of Service through uncontrolled memory consumption, as there are no built-in mechanisms to cap the volume of data processed or stored by this logging feature.
From a technical perspective, the vulnerability allows an unauthenticated attacker who can reach any route protected by BodyDump middleware to trigger repeated or concurrent allocations that exhaust process memory. By submitting excessively large request bodies or manipulating application logic to generate massive responses, an adversary can force the Go runtime to allocate substantial amounts of heap memory for each affected request. Since the middleware does not implement capture limits on response data, even small changes in server-side behavior that result in larger payloads can lead to disproportionate resource usage under concurrent load conditions. The lack of input validation or size constraints means that a single malicious actor or a distributed group of attackers can systematically deplete available memory resources, leading to application crashes or severe performance degradation for legitimate users.
The operational impact of this vulnerability is primarily centered on service availability and system stability. While BodyDump is not enabled by default in Echo configurations, its activation significantly expands the attack surface if proper external controls are not implemented. Although administrators may attempt to mitigate exposure through network-level request limits such as rate limiting or maximum payload size restrictions at a reverse proxy level, these measures do not bound response capture on the application server itself. Consequently, even with strict inbound constraints, an attacker could potentially exploit logic flaws that cause large outbound responses, thereby bypassing input-side protections and still achieving memory exhaustion against the backend process.
This vulnerability aligns with CWE-787: Out-of-bounds Read and CWE-400: Uncontrolled Resource Consumption within standard classification systems. In terms of offensive security frameworks, it corresponds to MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under the sub-category of resource exhaustion via application layer attacks. The flaw represents a classic case where logging or debugging features are enabled in production environments without adequate safeguards against abuse by untrusted inputs.
To mitigate this risk, organizations running Echo versions prior to 4.16.1 should upgrade immediately to version 4.16.1 or later, which includes the necessary fixes for memory management within BodyDump middleware. For deployments that cannot yet upgrade, it is critical to ensure that BodyDump middleware remains disabled in production environments unless absolutely required for debugging purposes. If logging must be active, administrators should implement strict size limits on both incoming request bodies and outgoing response buffers at the application level or via reverse proxy configurations before data reaches the Echo handler chain. Additionally, monitoring memory usage patterns can help detect anomalous allocation spikes indicative of such exploitation attempts in real time.