Echo (labstack/echo): three denial-of-service vulnerabilities in BodyDump, Decompress and WebSocket proxy middleware fixed in v4.16.1 / v5.4.1
Severity: high · Patch status: patched · Since 2026-10-23
Three coordinated advisories against the popular Go Echo framework (17K dependent repos) were published 2026-10-23, all fixed in v4.16.1 (and v5.4.1 for the proxy issue). BodyDump middleware captured request and response bodies without size limits, allowing memory exhaustion DoS (GHSA-f48p-c9v4-h7xv). Decompress middleware allowed unbounded gzip expansion, letting a small compressed request consume excessive memory/CPU (GHSA-h7wr-284f-5qvc). The Proxy middleware could retain handlers, goroutines and connections after WebSocket client disconnect, accumulating resources (GHSA-9969-6676-49h5, regression in v4.15.0+). All are opt-in middleware, not enabled by default, and no in-the-wild exploitation is known. Fixes add configurable capture/decompression limits (5 MiB default for BodyDump, 100 MiB for Decompress) and proper connection teardown.
What to do
- Upgrade github.com/labstack/echo/v4 to 4.16.1 (and echo/v5 to 5.4.1 if used)
- Audit which routes use BodyDump, Decompress and WebSocket proxy middleware and prioritize exposed ones
- If upgrading is delayed, disable BodyDump on exposed routes, place BodyLimit after Decompress, or disable WebSocket proxy routes
- Configure MaxRequestBytes/MaxResponseBytes and MaxDecompressedSize appropriately rather than relying on defaults
- Apply request deadlines and concurrency limits as defense in depth
Fixed versions
- github.com/labstack/echo/v4 4.16.1
- github.com/labstack/echo/v5 5.4.1
Sources
All live incidents on Threat Watch
