{"items":[{"id":"NVI-00009177","kind":"vulnerability","title":"Echo: BodyDump captures request and response bodies without size limits in v4","revision":4,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-f48p-c9v4-h7xv","CVE-2026-118260"],"plain_summary":"GitHub lists this reviewed advisory for github.com/labstack/echo/v4. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-09af2ba671c8e68ab3964928a7bbd0ff"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T20:17:05.730Z","value":"8.2 HIGH (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-8067ddbd3263061aedaf4b125e5762d8"},{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"0.372%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.31109. Missing scores are unknown.","source_id":"sr-09af2ba671c8e68ab3964928a7bbd0ff"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-e20421f562ded43dfde08a9e6e165f76","url":"https://github.com/advisories/GHSA-f48p-c9v4-h7xv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f48p-c9v4-h7xv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"},{"id":"sr-8067ddbd3263061aedaf4b125e5762d8","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118260","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-118260","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-03T09:59:08.616Z"},{"id":"sr-09af2ba671c8e68ab3964928a7bbd0ff","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-118260","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:15:58.844Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-e20421f562ded43dfde08a9e6e165f76"],"technology":"github.com/labstack/echo/v4","known_exclusions":[],"conditions_summary":"## Impact\n\nEcho v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation.\n\nRepeated or concurrent requests can exhaust process memory and cause denial of service. BodyDump is not enabled by default. Deployments with effective request limits may reduce the request-side exposure; response capture requires separate consideration.\n\n## Affected versions and patch\n\nEcho v4 versions through v4.16.0 are affected. Upgrade to v4.16.1.\n\nThe patch adds `BodyDumpConfig.MaxRequestBytes` and `MaxResponseBytes`, each defaulting to 5 MiB when zero. A value of `-1` explicitly restores unlimited capture. The complete request remains readable by the handler and the complete response is delivered to the client; only the callback's captured data is bounded. Request close behavior and read errors are preserved.","public_affected_ranges":[">= 4.0.0, < 4.16.1"]}],"null_published_at":"2026-11-08T15:11:49.379Z","source_updated_at":"2026-10-28T18:57:36.000Z","source_disclosed_at":"2026-10-23T20:48:44.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:56:36.327Z"},{"id":"NVI-00009177","kind":"vulnerability","title":"Echo: BodyDump captures request and response bodies without size limits in v4","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f48p-c9v4-h7xv","CVE-2026-118260"],"plain_summary":"GitHub lists this reviewed advisory for github.com/labstack/echo/v4. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-09af2ba671c8e68ab3964928a7bbd0ff"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-02T12:00:30.000Z","value":"0.372%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.31109. Missing scores are unknown.","source_id":"sr-09af2ba671c8e68ab3964928a7bbd0ff"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-e20421f562ded43dfde08a9e6e165f76","url":"https://github.com/advisories/GHSA-f48p-c9v4-h7xv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f48p-c9v4-h7xv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"},{"id":"sr-09af2ba671c8e68ab3964928a7bbd0ff","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-118260","publisher":"FIRST EPSS","observed_at":"2026-11-02T20:15:58.844Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-e20421f562ded43dfde08a9e6e165f76"],"technology":"github.com/labstack/echo/v4","known_exclusions":[],"conditions_summary":"## Impact\n\nEcho v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation.\n\nRepeated or concurrent requests can exhaust process memory and cause denial of service. BodyDump is not enabled by default. Deployments with effective request limits may reduce the request-side exposure; response capture requires separate consideration.\n\n## Affected versions and patch\n\nEcho v4 versions through v4.16.0 are affected. Upgrade to v4.16.1.\n\nThe patch adds `BodyDumpConfig.MaxRequestBytes` and `MaxResponseBytes`, each defaulting to 5 MiB when zero. A value of `-1` explicitly restores unlimited capture. The complete request remains readable by the handler and the complete response is delivered to the client; only the callback's captured data is bounded. Request close behavior and read errors are preserved.","public_affected_ranges":[">= 4.0.0, < 4.16.1"]}],"null_published_at":"2026-11-03T17:49:15.032Z","source_updated_at":"2026-10-28T18:57:36.000Z","source_disclosed_at":"2026-10-23T20:48:44.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:56:36.327Z"},{"id":"NVI-00009177","kind":"vulnerability","title":"Echo: BodyDump captures request and response bodies without size limits in v4","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f48p-c9v4-h7xv","CVE-2026-118260"],"plain_summary":"GitHub lists this reviewed advisory for github.com/labstack/echo/v4. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-76e3782f95df50dfeeb8bb8fe121762f"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.372%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.31121. Missing scores are unknown.","source_id":"sr-76e3782f95df50dfeeb8bb8fe121762f"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-e20421f562ded43dfde08a9e6e165f76","url":"https://github.com/advisories/GHSA-f48p-c9v4-h7xv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f48p-c9v4-h7xv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"},{"id":"sr-76e3782f95df50dfeeb8bb8fe121762f","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-118260","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:15.375Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-e20421f562ded43dfde08a9e6e165f76"],"technology":"github.com/labstack/echo/v4","known_exclusions":[],"conditions_summary":"## Impact\n\nEcho v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation.\n\nRepeated or concurrent requests can exhaust process memory and cause denial of service. BodyDump is not enabled by default. Deployments with effective request limits may reduce the request-side exposure; response capture requires separate consideration.\n\n## Affected versions and patch\n\nEcho v4 versions through v4.16.0 are affected. Upgrade to v4.16.1.\n\nThe patch adds `BodyDumpConfig.MaxRequestBytes` and `MaxResponseBytes`, each defaulting to 5 MiB when zero. A value of `-1` explicitly restores unlimited capture. The complete request remains readable by the handler and the complete response is delivered to the client; only the callback's captured data is bounded. Request close behavior and read errors are preserved.","public_affected_ranges":[">= 4.0.0, < 4.16.1"]}],"null_published_at":"2026-11-01T19:14:01.603Z","source_updated_at":"2026-10-28T18:57:36.000Z","source_disclosed_at":"2026-10-23T20:48:44.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:56:36.327Z"},{"id":"NVI-00009177","kind":"vulnerability","title":"Echo: BodyDump captures request and response bodies without size limits in v4","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f48p-c9v4-h7xv","CVE-2026-118260"],"plain_summary":"GitHub lists this reviewed advisory for github.com/labstack/echo/v4. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-e20421f562ded43dfde08a9e6e165f76"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-e20421f562ded43dfde08a9e6e165f76","url":"https://github.com/advisories/GHSA-f48p-c9v4-h7xv","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f48p-c9v4-h7xv","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:36.327Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-e20421f562ded43dfde08a9e6e165f76"],"technology":"github.com/labstack/echo/v4","known_exclusions":[],"conditions_summary":"## Impact\n\nEcho v4's opt-in BodyDump middleware read complete request bodies into memory and retained complete response bodies without a capture limit. A client able to submit large requests to a route using BodyDump could cause large allocations before the application handler ran. Large responses, including responses whose size can be influenced by a client, also caused an additional unbounded capture allocation.\n\nRepeated or concurrent requests can exhaust process memory and cause denial of service. BodyDump is not enabled by default. Deployments with effective request limits may reduce the request-side exposure; response capture requires separate consideration.\n\n## Affected versions and patch\n\nEcho v4 versions through v4.16.0 are affected. Upgrade to v4.16.1.\n\nThe patch adds `BodyDumpConfig.MaxRequestBytes` and `MaxResponseBytes`, each defaulting to 5 MiB when zero. A value of `-1` explicitly restores unlimited capture. The complete request remains readable by the handler and the complete response is delivered to the client; only the callback's captured data is bounded. Request close behavior and read errors are preserved.","public_affected_ranges":[">= 4.0.0, < 4.16.1"]}],"null_published_at":"2026-10-31T22:13:31.288Z","source_updated_at":"2026-10-28T18:57:36.000Z","source_disclosed_at":"2026-10-23T20:48:44.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:36.327Z"}],"next_cursor":null,"snapshot_revision":"42594"}