CVE-2026-118263

Description

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1.

Is your site exposed to CVE-2026-118263?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-252 CWE-252

References

Other References

https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec https://github.com/labstack/echo/pull/3105 https://github.com/labstack/echo/releases/tag/v5.4.1 https://github.com/labstack/echo/security/advisories/GHSA-x9ff-22gv-65f4

Frequently Asked Questions

What is CVE-2026-118263? +

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1.

How do I check if I'm vulnerable to CVE-2026-118263? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-78699

Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name that …

CVE-2026-18397

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and …

CVE-2025-29938

An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to write to an arbitrary …

CVE-2025-0028

An unchecked return value within the AMD Platform Management Framework (PMF) could allow an attacker to read or modify an …

CVE-2025-1394

The Ember ZNet stack’s packet buffer manager may read out of bound memory leading to an assert, causing a Denial …

CVE-2026-67409

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP …