{"affected":[{"product":"echo","source":"CNA: GitHub_M","vendor":"labstack","versions":[{"status":"affected","version":">= 5.0.0, < 5.4.1"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/labstack/echo/v5","product":"github.com/labstack/echo/v5","source":"OSV GHSA-x9ff-22gv-65f4","vendor":"","versions":[{"events":[{"introduced":"5.0.0"},{"fixed":"5.4.1"}],"lessThan":"5.4.1","status":"affected","version":"5.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-118263","cwes":["CWE-252"],"description":"Echo is a Go web framework. From 5.0.0 until 5.4.1, Echo v5's BodyDump middleware can discard a BodyLimit overflow error for an unknown-length request when BodyDump's capture limit is below the BodyLimit threshold. BodyDump drains the remaining body while ignoring read errors and replaces it with the captured prefix, so an HTTP/1.1 chunked request can be truncated and processed successfully even though the original body exceeded the configured limit. Known-length requests rejected before BodyDump runs are unaffected, and the issue does not establish a general authentication bypass or denial of service. This issue is fixed in 5.4.1.","epss":{"date":"2026-11-02","percentile":0.32597,"score":0.00385},"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793651892788,"publishedAt":1793214090268,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/labstack/echo/security/advisories/GHSA-x9ff-22gv-65f4"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/pull/3105"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/commit/1855061e572ae9dab727c811d8382f266bfbaaec"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/labstack/echo/releases/tag/v5.4.1"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-x9ff-22gv-65f4"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-x9ff-22gv-65f4"}],"remediation":[{"kind":"fix","source":"OSV GHSA-x9ff-22gv-65f4","text":"github.com/labstack/echo/v5 (Go): OSV reports a fixed version 5.4.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-x9ff-22gv-65f4"}],"revision":"5361d86ee35d58e25a5f0815d2d312cfd25a95b18a25ade51b89e7a9c76fe378","sources":[{"modifiedAt":1793651892788,"name":"CNA: GitHub_M","retrievedAt":1793653757093,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118263"},{"modifiedAt":1793214903299,"name":"OSV / GitHub Security Advisories","retrievedAt":1793653759354,"url":"https://osv.dev/vulnerability/GHSA-x9ff-22gv-65f4"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793653779809,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118263"}],"ssvc":{"assessedAt":1793651883408,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests","updatedAt":1793653779809}