CVE-2026-118263

Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1.

• CWE-252

• https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec
• https://github.com/labstack/echo/pull/3105
• https://github.com/labstack/echo/releases/tag/v5.4.1
• https://github.com/labstack/echo/security/advisories/GHSA-x9ff-22gv-65f4

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118258i18next-http-backend is a backend layer for i18next that loa…3.7
• CVE-2026-118259opentelemetry-java is the Java implementation of the OpenTel…5.3
• CVE-2026-11826OpenPLC_v3 contains a heap-based buffer overflow in the getD…8.8
• CVE-2026-118260Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4…8.2
• CVE-2026-118261Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4…8.2
• CVE-2026-118262Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4…8.2
• CVE-2026-118264Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.…9.1
• CVE-2026-118265Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5'…5.3
• CVE-2026-118266Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo'…5.3
• CVE-2026-11827GitLab has remediated an issue in GitLab EE affecting all ve…4.9
• CVE-2026-118271A security vulnerability has been detected in a2ui-project a…4.3
• CVE-2026-118272A vulnerability was detected in a2ui-project a2ui up to 0.10…4.3