{"id":"GO-2026-6842","revision":"2f7c40b5c7ae462384e664ddc6a6fc7b","records":[{"revision":"2f7c40b5c7ae462384e664ddc6a6fc7b","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6842","aliases":["CVE-2026-118261","GHSA-h7wr-284f-5qvc"],"title":"Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo","description":"Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo","state":0,"publishedAt":"2026-11-05T22:54:11+00:00","modifiedAt":"2026-11-05T23:25:47.7304717+00:00","affected":[{"ecosystem":"Go","name":"github.com/labstack/echo/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.16.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/labstack/echo/security/advisories/GHSA-h7wr-284f-5qvc","https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f","https://github.com/labstack/echo/pull/3136","https://github.com/labstack/echo/releases/tag/v4.16.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6842","license":"OSV · upstream source license applies","key":"osv:GO-2026-6842","identifiers":["GO-2026-6842","CVE-2026-118261","GHSA-h7wr-284f-5qvc"]},"retained":false,"historicalAffected":[]}],"coverage":[]}