{"id":"ghsa-ghsa-x9ff-22gv-65f4","seq":661335,"kind":"advisory","title":"Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests","url":"https://github.com/advisories/GHSA-x9ff-22gv-65f4","permalink":"https://vulnpulse.app/items/ghsa-ghsa-x9ff-22gv-65f4","summary":"影響: go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1\nEcho v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring read errors, and then replaced the body with the captured prefix. With an outer BodyLimit, an unknown-length request such as an HTTP/1.1 chunked request, and a BodyDump capture limit below the BodyLimit threshold, an overflow detected during that drain could be discarded. The handler could consequently process a truncated request and return success even though the original body exceeded th…","severity":"medium","techs":["go","github"],"cves":[],"tags":["GHSA-x9ff-22gv-65f4","github.com/labstack/echo/v5"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T20:49:11.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}