{"id":"CVE-2026-118261","sourceIdentifier":"security-advisories@github.com","published":"2026-10-28T19:17:30.810","lastModified":"2026-11-04T23:10:00.223","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1."},{"lang":"es","value":"Echo es un framework web de Go. Desde la versión 4.0.0 hasta la 4.16.1 incluida, el middleware de descompresión opcional de Echo v4 expone un flujo de solicitud decodificado con gzip sin limitar su tamaño expandido. Una solicitud comprimida pequeña puede expandirse a un cuerpo muy grande cuando un manejador la lee o la vincula, consumiendo memoria o CPU excesivas y permitiendo que solicitudes repetidas o concurrentes causen denegación de servicio. El middleware no está habilitado por defecto, y limitar solo el tamaño de la solicitud comprimida no limita el tamaño decodificado. Este problema se corrige en la versión 4.16.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"labstack","product":"echo","versions":[{"version":">= 4.0.0, < 4.16.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-29T15:28:34.378293Z","id":"CVE-2026-118261","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-409"}]}],"references":[{"url":"https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","source":"security-advisories@github.com"},{"url":"https://github.com/labstack/echo/releases/tag/v4.16.1","source":"security-advisories@github.com"},{"url":"https://github.com/labstack/echo/security/advisories/GHSA-h7wr-284f-5qvc","source":"security-advisories@github.com"}]}