Is CVE-2026-118260 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118260 being exploited in the wild.

How severe is CVE-2026-118260?

Informational severity, published 28 October 2026.

Which products and versions are affected?

github.com/labstack/echo/v4 (Go) SEMVER:introduced=4.0.0,fixed=4.16.1; Labstack Echo 4.0.0 to 4.16.0.

How is CVE-2026-118260 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118260?

Check whether you run github.com/labstack/echo/v4 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118260: Echo BodyDump middleware unbounded memory allocation

CVE-2026-118260 · Severity: info · Published 2026-10-28

Echo is a popular Go web framework used to build REST APIs and web services. The BodyDump middleware, which can be optionally enabled to log request and response bodies for debugging, reads entire request and response bodies into memory without limits. An attacker can exploit this by sending very large requests or causing large responses, exhausting the server's memory and causing denial of service.

Technologies: github.com/labstack/echo/v4 (Go), Labstack Echo. Vendors: Go, Labstack.

Quick answers

Is CVE-2026-118260 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118260 being exploited in the wild.
How severe is CVE-2026-118260?: Informational severity, published 28 October 2026.
Which products and versions are affected?: github.com/labstack/echo/v4 (Go) SEMVER:introduced=4.0.0,fixed=4.16.1; Labstack Echo 4.0.0 to 4.16.0.
Is there a fix for CVE-2026-118260?: Yes. github.com/labstack/echo/v4 (Go): upgrade to 4.16.1 or later. Until then: If upgrading is not immediately possible, do not enable the BodyDump middleware, or configure BodyDumpConfig.MaxRequestBytes and MaxResponseBytes to appropriate limits for your use case (the fix defaults these to 5 MiB each). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118260 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118260?: Check whether you run github.com/labstack/echo/v4 (Go) or Labstack Echo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/labstack/echo/v4 (Go): upgrade to 4.16.1 or later
```
go get github.com/labstack/echo/v4@v4.16.1
```

If upgrading is not immediately possible, do not enable the BodyDump middleware, or configure BodyDumpConfig.MaxRequestBytes and MaxResponseBytes to appropriate limits for your use case (the fix defaults these to 5 MiB each).

Technical details

The BodyDump middleware in Echo v4 versions 4.0.0 through 4.16.0 captures complete request and response bodies into memory during request processing without enforcing size limits. An unauthenticated remote attacker can send large HTTP request bodies or trigger responses with large payloads to cause repeated memory allocations that exhaust process memory. The vulnerability requires BodyDump to be explicitly enabled and affects the middleware's capture path only; handlers and clients still receive complete bodies.

Affected products

labstack Echo 4.0.0 to 4.16.0

Identifiers

CVE-2026-118260
GHSA-f48p-c9v4-h7xv
GO-2026-6840

Timeline

2026-10-28: disclosed
2026-10-22: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.