CVE-2026-118261: 
Wolfi vulnerability analysis and mitigation

CVE-2026-118261 is a denial-of-service vulnerability in the Echo Go web framework's opt-in Decompress middleware, caused by unbounded gzip decompression ("zip bomb" / data amplification). It affects Echo v4 versions from 4.0.0 up to (but not including) 4.16.1, and was disclosed on October 28, 2026. The vulnerability carries a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is improper handling of highly compressed data (CWE-409) combined with uncontrolled resource consumption (CWE-400). Echo v4's Decompress middleware passes the gzip-decoded request stream directly to handlers without enforcing any limit on the expanded size; only the compressed request size could previously be bounded, which does not constrain the decompressed output. An attacker can craft a small, highly compressed gzip payload (a "zip bomb") that expands to a very large body when a handler reads or binds it, exhausting server memory or CPU. The fix introduces DecompressConfig.MaxDecompressedSize, defaulting to 100 MiB, with HTTP 413 returned for overflows — implemented via a limitedGzipReader wrapper in middleware/decompress.go (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to cause denial of service by sending repeated or concurrent small compressed requests that expand into massive decompressed payloads, consuming excessive memory and CPU on the server. This can degrade or crash services built on Echo v4 that have the Decompress middleware enabled. There is no confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that the target application has explicitly enabled the Decompress middleware, which is not on by default, reducing the exposed attack surface (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing services built on Echo v4 (e.g., via HTTP response headers, framework fingerprinting, or open-source intelligence) that accept gzip-encoded request bodies, indicating the Decompress middleware may be active.
2. Craft a zip bomb payload: Generate a highly compressed gzip file whose decompressed size is very large (e.g., hundreds of MiB or GiB) but whose compressed size is small enough to pass any compressed-size limits.
3. Send the malicious request: Submit an HTTP POST (or other body-bearing method) request to any endpoint on the target, setting the Content-Encoding: gzip header and including the crafted payload as the request body.
4. Trigger decompression: The Decompress middleware decompresses the body before passing it to the handler; without a decompressed-size limit (versions < 4.16.1), the server allocates memory proportional to the expanded size.
5. Repeat or parallelize: Send multiple concurrent requests to amplify resource exhaustion, causing the server process to run out of memory or CPU, resulting in service degradation or crash (GitHub Advisory).

• Network: Unusual HTTP requests with Content-Encoding: gzip headers where the Content-Length is small but handler processing time is abnormally long; high volume of concurrent gzip-encoded POST requests from one or more source IPs.
• Logs: Server access logs showing repeated requests to the same endpoint with Content-Encoding: gzip; application logs recording out-of-memory errors or panics in the Echo middleware chain; HTTP 413 responses after patching (indicating exploitation attempts against a patched server).
• Process/System: Sudden spikes in memory consumption or CPU usage by the Go application process without a corresponding increase in legitimate traffic; OOM-killer events in system logs (dmesg or /var/log/syslog) attributable to the Echo service process.

Upgrade Echo v4 to version 4.16.1 or later, which introduces DecompressConfig.MaxDecompressedSize defaulting to 100 MiB; bodies exceeding the limit receive HTTP 413, including through JSON and XML binding (GitHub Release). If upgrading immediately is not possible, disable the Decompress middleware on exposed routes, or place the BodyLimit middleware after Decompress so the application-level limit applies to decoded bytes. Additionally, apply request deadlines and concurrency limits at the infrastructure level (e.g., reverse proxy timeouts, connection rate limiting) to reduce the impact of repeated requests (GitHub Advisory).

The vulnerability was reported by community contributor @q490107865, with exact-limit boundary handling contributed by @Shubham-Padkonde (PR #3136), reflecting active community engagement in Echo's security process. The fix was released as part of a broader Echo v4.16.1 security update addressing multiple advisories simultaneously. No significant independent media coverage or notable researcher commentary beyond the GitHub advisory has been identified at this time (GitHub Advisory, GitHub Release).