Echo v4 includes an optional BodyDump middleware that reads entire request bodies into memory before handlers execute and stores complete response bodies for the callback without any capture limits. An unauthenticated client that reaches a route that has BodyDump enabled can submit arbitrarily large request payloads or trigger large responses, causing the middleware to allocate repeated or concurrent memory blocks until the process exhausts its available memory. This leads to a denial of service without requiring any special privileges or authentication. The nature of the flaw is a resource exhaustion, identified as a buffer or memory limit issue.

The vulnerability affects the Labstack Echo web framework, version 4.0.0 through 4.16.1. Any deployment that imports Labstack Echo v4 and has the BodyDump middleware enabled in one or more routes is impacted. The issue is fixed in Echo v4.16.1 and later, where BodyDump no longer captures unbounded bodies, or can be configured with limits.

The overall CVSS score is 8.2, indicating a high severity of the flaw. An attacker does not need authentication and only needs the ability to send HTTP requests to a route protected by BodyDump. The EPSS score is not reported, but the absence of a KEV listing suggests that exploit tooling is not widely available. Nevertheless, because the exploitation simply requires the ability to craft large requests or responses, the risk of memory exhaustion is significant in environments lacking robust request‑size restrictions or when BodyDump is enabled indiscriminately.