Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

影響: go:github.com/labstack/echo/v5 >= 5.0.0, < 5.4.1 → 5.4.1

Echo v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring read errors, and then replaced the body with the captured prefix. With an outer BodyLimit, an unknown-length request such as an HTTP/1.1 chunked request, and a BodyDump capture limit below the BodyLimit threshold, an overflow detected during that drain could be discarded. The handler could consequently process a truncated request and return success even though the original body exceeded th…

GitHub Advisory Database에서 읽기

2026. 10. 24. 오전 05:49, GitHub Advisory Database에서 "Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Go, GitHub.