{"id":"ghsa-ghsa-f48p-c9v4-h7xv","seq":661336,"kind":"advisory","title":"Echo: BodyDump captures request and response bodies without size limits in v4","url":"https://github.com/advisories/GHSA-f48p-c9v4-h7xv","permalink":"https://vulnpulse.app/items/ghsa-ghsa-f48p-c9v4-h7xv","summary":"影響: go:github.com/labstack/echo/v4 >= 4.0.0, < 4.16.1 → 4.16.1\nEcho v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation. Repeated or concurrent requests can exhaust process memory and cause denial of service. Body…","severity":"high","techs":["go","github"],"cves":[],"tags":["GHSA-f48p-c9v4-h7xv","github.com/labstack/echo/v4"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T20:48:44.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}