Echo Web Framework EUVD-2026-112395

Exploitation requires an application built on Echo v5 (5.0.0-5.4.0) that enables the BodyDump middleware with its MaxRequestBytes capture limit set BELOW the enforced BodyLimit threshold, and the attacker must send an unknown-length request - specifically an HTTP/1.1 chunked request - whose body exceeds BodyLimit. Limiting factors: known-length (Content-Length) requests are rejected before BodyDump runs and are unaffected; the vulnerable path only exists when BodyDump's capture cap is below BodyLimit (a non-default, operator-chosen combination); and impact is confined to bypassing the size policy, not authentication or availability. Workarounds per the advisory: disable BodyDump on affected routes, or set the capture limit above the enforced body limit so the overflow is detected during initial capture.

This is a genuinely medium/low-priority issue, not a high-severity emergency. The CVSS 4.0 score of 6.3 (vendor/NVD) reflects a network-reachable, unauthenticated flaw (AV:N, PR:N, UI:N) but with AT:P - an attack requirement - and only low integrity impact (VI:L; VC:N, VA:N). No CISA KEV listing and no EPSS score are provided, and no public exploit code is referenced beyond the patch commit, PR, release, and GHSA advisory. The vuln.today decision label is 'this_month', consistent with a conditional, bounded bug rather than act-now urgency. Importantly, the input Tags 'Authentication Bypass' and 'Denial Of Service' directly conflict with the GHSA advisory, which explicitly states 'no general authentication bypass, production data modification or denial of service is claimed' - treat those tags as inaccurate. The real impact is a conditional request-size-policy bypass that only manifests under a specific non-default middleware configuration, so despite the network vector this is a targeted, low-probability concern rather than a widespread exploitation risk.

An application runs Echo v5 (5.0.0-5.4.0) with BodyDump middleware whose capture limit (MaxRequestBytes) is set below the configured BodyLimit. An attacker sends an HTTP/1.1 chunked (unknown-length) request whose body exceeds BodyLimit; BodyDump drains the remainder while ignoring the read error and hands the handler the captured prefix, so the oversized request is truncated and processed as successful instead of being rejected. No public exploit code is identified at time of analysis; the only referenced code is the fix commit.