CVE-2026-118263
Description
A flaw was found in Echo's BodyDump middleware. A remote attacker can exploit this vulnerability to bypass configured request body limits and cause the application to process truncated data. When handling requests of unknown length, such as chunked HTTP requests, the middleware discards overflow errors if its capture limit is set lower than the server's body limit. Consequently, the application processes an incomplete request rather than rejecting the oversized payload.
Statement
This vulnerability is rated as Moderate severity because exploitation requires a specific configuration combining both BodyDump and BodyLimit middlewares where the capture threshold is set below the enforced body limit. Furthermore, the issue only impacts indeterminate-length or chunked HTTP requests, as standard requests with fixed Content-Length headers are rejected before reaching the vulnerable logic. As a result, the flaw allows an attacker to bypass payload size boundaries and force truncation rather than enabling remote code execution, authentication compromise, or denial of service.
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: Unexpected State; Varies by Context; DoS: Crash, Exit, or Restart
The product could be prevented from detecting unexpected states and conditions, placing the product into a state that could lead to a crash or other unintended behaviors.
Access Control
Technical Impact: Bypass Protection Mechanism
If the method/function is used for a protection mechanism, then an unchecked return value could prevent the code from being able to see if the protection mechanism fails. For example, if the program calls a function to drop privileges but does not check the return code to ensure that privileges were successfully dropped, then the program will continue to operate with the higher privileges.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
