{"id":"GO-2026-6840","summary":"Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo","details":"Echo: BodyDump captures request and response bodies without size limits in v4 in github.com/labstack/echo","aliases":["CVE-2026-118260","GHSA-f48p-c9v4-h7xv"],"modified":"2026-11-05T23:26:11.132455771Z","published":"2026-11-05T22:54:11Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6840","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/labstack/echo/security/advisories/GHSA-f48p-c9v4-h7xv"},{"type":"FIX","url":"https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"},{"type":"FIX","url":"https://github.com/labstack/echo/pull/3105"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v4.16.1"}],"affected":[{"package":{"name":"github.com/labstack/echo/v4","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.16.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/labstack/echo/v4/middleware","symbols":["BodyDump","BodyDumpWithConfig","Decompress","DecompressWithConfig","Proxy","ProxyWithConfig","proxyHTTP","proxyRaw"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6840.json"}}],"schema_version":"1.9.2"}