CVE-2026-118261 · GHSA-h7wr-284f-5qvc

Echo: Decompress permits unbounded gzip expansion in v4

Risk score: 59/100
CVSS: 8.2 v4.0
Published: 23 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or…
Affected: github.com/labstack/echo/v4 (go) >= 4.0.0, < 4.16.1
Fix: Upgrade github.com/labstack/echo/v4 to 4.16.1 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

github.com/labstack/echo/v4: Amber, patch this week. Echo, a Go web framework, has a vulnerability where rejected WebSocket upgrades can bypass access controls. An attacker could exploit this to send HTTP requests directly to an upstream without passing through Echo's router or route-specific middleware.

The flaws

CVE-2026-118261: Echo: Decompress permits unbounded gzip expansion in v4 (CVSS 8.2)
CVE-2026-118264: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls (CVSS 9.1)
CVE-2026-118262: Echo: WebSocket proxy can retain connections and handlers after client disconnect (CVSS 8.2)
CVE-2026-118260: Echo: BodyDump captures request and response bodies without size limits in v4 (CVSS 8.2)

The fix

Upgrade github.com/labstack/echo/v4: 4.16.1 · 5.4.1 or later on your release line

Who is exposed: {'products': ['Echo'], 'packages': [{'ecosystem': 'go', 'name': 'github.com/labstack/echo/v4', 'vulnerable': '>= 4.0.0, < 4.16.1'}, {'ecosystem': 'go', 'name': 'github.com/labstack/echo/v5', 'vulnerable': '>= 5.0.0, < 5.4.1'}]}

Where it stands

No known exploitation

Connects to

Same weakness: Denial of service (CWE-400). 271 other warnings in 30 days

Why it is Yellow

CVSS 8.2 high
Remotely exploitable without logging in
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/labstack/echo/v4	go	>= 4.0.0, < 4.16.1	4.16.1

References

Original description

Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.

Last activity 28 Oct 2026. Patch Forecast updates every hour.