CVE-2026-118263

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with...

CVE-2026-118263 Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with...

CVE-2026-118263

The Echo Go web framework (v5.0.0 through v5.4.0) contains a vulnerability in the BodyDump middleware. When handling unknown-length requests (e.g., HTTP/1.1 chunked ) where the BodyDump capture limit is lower than the BodyLimit threshold, the middleware may discard a BodyLimit overflow error. It ...

PT-2026-129133

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with...