CVE-2026-118263

Name of the Vulnerable Software and Affected Versions Echo versions 5.0.0 through 5.4.0

Description The BodyDump middleware in Echo v5 can discard a BodyLimit overflow error for requests with an unknown length, such as HTTP/1.1 chunked requests. This occurs when the BodyDump capture limit is set lower than the BodyLimit threshold. The middleware drains the remaining body while ignoring read errors and replaces the body with the captured prefix, allowing a truncated request to be processed successfully despite exceeding the configured size limit. This results in a conditional size-policy bypass.

Recommendations Update Echo to version 5.4.1. Disable BodyDump on affected routes. Set the BodyDump capture limit above the enforced BodyLimit threshold.