Allocation of Resources Without Limits or Throttling Affecting github.com/labstack/echo/v4/middleware package, versions >=4.0.0 <4.16.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMLABSTACKECHOV4MIDDLEWARE-21691665
- published24 Oct 2026
- disclosed23 Oct 2026
- creditUnknown
Introduced: 23 Oct 2026
New CVE NOT AVAILABLE CWE-400 (opens in a new tab)How to fix?
Upgrade github.com/labstack/echo/v4/middleware to version 4.16.1 or higher.
Overview
github.com/labstack/echo/v4/middleware is a middleware package for echo.
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the BodyDump middleware. An attacker can exhaust process memory and disrupt service availability by submitting large requests or influencing large responses, leading to unbounded memory allocations. This is only exploitable if the BodyDump middleware is enabled.
Workaround
This vulnerability can be mitigated by disabling BodyDump on exposed routes, especially those handling large uploads or downloads, or by enforcing body-size limits before BodyDump and independently bounding application-generated responses.