Echo v4 EUVD-2026-112369

Exploitation requires that the opt-in BodyDump middleware is enabled on a route the attacker can reach; BodyDump is not enabled by default, so default Echo deployments are not exposed. Given that condition, exploitation is unauthenticated (PR:N) and remote - the attacker submits large request bodies or influences large responses so the middleware buffers the complete body/response in memory per request. Key limiting factors: the middleware must be explicitly configured; external/front-end request-size limits can bound the request-side allocation but, per the advisory, do NOT bound response capture, so routes returning large or client-influenced responses remain exposed even behind request limits. Impact is confined to availability (process memory exhaustion / DoS); there is no confidentiality or integrity impact.

This is a CWE-400/CWE-770 uncontrolled memory-consumption denial-of-service flaw in Echo v4's opt-in BodyDump middleware, carrying a vendor CVSS 4.0 score of 8.2 driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N). The vector reports network reach and low complexity but AT:P, indicating a non-attacker-controlled precondition - consistent with the fact that BodyDump is not enabled by default and must be configured on a reachable route. PR:N confirms the CVSS model treats this as unauthenticated once such a route is exposed. No EPSS score and no KEV listing are present in the input, and no public exploit code is referenced - the only links are the patch commit, release tag, and GHSA advisory - so there is no public exploit identified at time of analysis. The vuln.today priority is 'this_week' rather than act_now/emergency, which aligns with the signals: real but conditional risk, gated on operators having deliberately enabled BodyDump, and limited to availability. The headline 8.2 should therefore be read as high-impact-but-conditional: environments not using BodyDump are unaffected, so prioritization should hinge on whether BodyDump is deployed on externally reachable routes rather than on the raw score.

An operator has enabled Echo's opt-in BodyDump middleware on an internet-facing route (e.g. for request/response logging). An unauthenticated attacker repeatedly sends very large request bodies, or triggers handlers that return large client-influenced responses, forcing BodyDump to buffer the full request and response in memory per request; repeated or concurrent requests exhaust process memory and crash the service. No public exploit code is referenced in the input, only patch and advisory links.