Unchecked Return Value Affecting github.com/labstack/echo/v4/middleware package, versions <4.16.1

github.com/labstack/echo/v4/middleware is a middleware package for echo.

Affected versions of this package are vulnerable to Unchecked Return Value via the BodyDump middleware in middleware/body_dump.go. An attacker can cause a handler to accept a truncated request despite the configured BodyLimit by sending an unknown-length, such as chunked, request that exceeds the BodyLimit threshold when BodyDump’s capture limit is smaller. BodyDump drains the remaining request body while ignoring read errors, discarding the overflow error before the handler processes the captured prefix.

Notes

• The overflow-error suppression occurs when BodyLimit wraps BodyDump, so its limited reader is the one BodyDump drains; this middleware ordering is required for the described error-discard path.

Workarounds

• Disable BodyDump on affected routes to prevent it from draining the request body and discarding the BodyLimit overflow error.
• Set BodyDumpConfig.MaxRequestBytes above the enforced BodyLimit so the overflow is detected during BodyDump’s initial capture.

• GitHub Commit
• GitHub Commit v4.16.1
• GitHub PR
• Maintainer's Advisory