Echo v4: Denial of service via unbounded gzip decompression
Summary
The opt-in Decompress middleware in Echo v4 passes gzip-decoded request bodies on without a size limit. A small compressed request can expand to a very large body when a handler reads or binds it, consuming excessive memory or CPU. Repeated or concurrent requests can cause a denial of service. The middleware is not enabled by default, and limiting only the compressed size does not prevent this.
Affected
- labstack/echo v4 from 4.0.0 before 4.16.1 (the Decompress middleware must be in use)
Fixed in
- Upgrade to v4.16.1 (go get github.com/labstack/echo/v4@v4.16.1)
- Go 1.26 or later is required for the patched golang.org/x dependencies
- Distribution-specific fix versions: Unknown.
Workaround
- Disable gzip request decompression on exposed routes
- Place the BodyLimit middleware after Decompress so that the limit applies to the decoded bytes
- Use DecompressConfig.MaxDecompressedSize in v4.16.1 (default 100 MiB, -1 disables the limit)
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial
- VulDB reports no public exploit
- No reports of active exploitation found; CISA KEV status not verified
- EPSS: 0.37 % (percentile 31)
Our recommendation
- Check whether Echo applications use the Decompress middleware and read or bind request bodies (review go.mod and code)
- Upgrade affected applications to v4.16.1 or later
- Prioritise internet-facing APIs that accept gzip-encoded request bodies
- Monitor memory and CPU usage of these services for unusual spikes
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-h7wr-284f-5qvc github.com
- Echo release v4.16.1 github.com
- Fix commit 3fb0ba7e github.com
- OSV CVE-2026-118261 osv.dev
- GitLab advisory mirror GHSA-h7wr-284f-5qvc advisories.gitlab.com
- VulDB CVE-2026-118261 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:45.
Original description (NVD)
Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.