CVE-2026-118261
Description
A flaw was found in Echo's Decompress middleware. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending small, compressed requests that expand into excessively large payloads upon decompression. Because the middleware does not enforce a limit on the expanded data size, processing these requests consumes excessive memory and CPU resources, rendering the service unavailable.
Statement
This vulnerability is rated as having Important impact because an unauthenticated remote attacker can exhaust server memory and CPU resources with minimal network bandwidth, leading to service denial. The Decompress middleware is disabled by default in Echo, limiting real-world exposure to services that specifically activate gzip decompression for incoming requests. Deployments remain unaffected if they do not process compressed request bodies or if they enforce downstream size constraints on decoded payloads.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Amplification; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
System resources, CPU and memory, can be quickly consumed. This can lead to poor system performance or system crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
