{"id":"GO-2026-6842","summary":"Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo","details":"Echo: Decompress permits unbounded gzip expansion in v4 in github.com/labstack/echo","aliases":["CVE-2026-118261","GHSA-h7wr-284f-5qvc"],"modified":"2026-11-05T23:25:47.730471727Z","published":"2026-11-05T22:54:11Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6842"},"references":[{"type":"ADVISORY","url":"https://github.com/labstack/echo/security/advisories/GHSA-h7wr-284f-5qvc"},{"type":"FIX","url":"https://github.com/labstack/echo/commit/3fb0ba7e17645bb65611e2a08875d0a2f65c421f"},{"type":"FIX","url":"https://github.com/labstack/echo/pull/3136"},{"type":"WEB","url":"https://github.com/labstack/echo/releases/tag/v4.16.1"}],"affected":[{"package":{"name":"github.com/labstack/echo/v4","ecosystem":"Go","purl":"pkg:golang/github.com/labstack/echo/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.16.1"}]}],"ecosystem_specific":{"imports":[{"symbols":["BodyDump","BodyDumpWithConfig","Decompress","DecompressWithConfig","Proxy","ProxyWithConfig","proxyHTTP","proxyRaw"],"path":"github.com/labstack/echo/v4/middleware"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6842.json"}}],"schema_version":"1.9.2"}