Live › vulnerability › GHSA-x9ff-22gv-65f4
Go to dashboardEcho v5's BodyDump middleware can swallow the error that signals a request body exceeded the BodyLimit when the body has unknown length, such as chunked uploads. The handler then processes a truncated body and returns success even though the original body was over the configured limit.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 20:59 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/labstack/echo/v5 | go | >= 5.0.0, < 5.4.1 | 5.4.1 |
Check go.mod for github.com/labstack/echo/v5 and see whether the version is below 5.4.1 and whether the app uses middleware.BodyDump together with middleware.BodyLimit.
v5.4.1Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Echo v5's BodyDump middleware captured a bounded prefix, drained the remaining request body while ignoring read errors, and then replaced the body with the captured prefix. With an outer BodyLimit, an unknown-length request such as an HTTP/1.1 chunked request, and a BodyDump capture limit below the BodyLimit threshold, an overflow detected during that drain could be discarded.
The handler could consequently process a truncated request and return success even though the original body exceeded the configured limit. This is a conditional size-policy bypass; no general authentication bypass, production data modification or denial of service is claimed. Known-length requests rejected before BodyDump runs are unaffected by this path.
All v5 releases from v5.0.0 through v5.4.0 contain the affected drain-and-replace logic. Runtime reproduction confirmed v5.4.0; source comparison confirms the same request handling in v5.0.0.
Upgrade to v5.4.1. BodyDump now captures only the configured prefix for logging and reconstructs the handler's reader from that prefix plus the unread original stream. It preserves the original closer and read errors instead of silently draining the rest. Fix commit.
Streaming BodyLimit enforcement still requires the application to consume the request body and handle read errors. The BodyDump capture cap is a logging cap, not an application body limit.
Disable BodyDump on affected routes, or ensure the BodyLimit overflow is detected during the initial capture by setting the capture limit above the enforced body limit. Upgrading is recommended because it also preserves the complete body for handlers.
Reported by @Duodum. The fix incorporates @jakezwang's request-body preservation work in #3105.
This page as .md · .json · in your agent: get_signal("GHSA-x9ff-22gv-65f4")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.