CVE-2026-118261: falha de alta gravidade em labstack echo
Echo: Decompress permits unbounded gzip expansion in v4
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.4%
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
labstack · echoCVEs relacionadas — labstack echo
No mesmo produto, das mais perigosas para as menos.
CVE-2026-55677HIGHEcho: Encoded slash (%2F) bypasses route-level protection and exposes static filesEPSS 0.5%CVE-2026-118264CRITICALEcho: Rejected WebSocket upgrades can bypass Echo route-level access controlsEPSS 0.4%CVE-2026-118653MEDIUMEcho: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default ConfigurationEPSS 0.4%CVE-2026-118650HIGHEcho: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served pathEPSS 0.4%CVE-2026-118263MEDIUMEcho: BodyDump can discard BodyLimit overflow errors for unknown-length requestsEPSS 0.4%CVE-2026-25766MEDIUMEcho has a Windows path traversal via backslash in middleware.Static default filesystemEPSS 0.4%