Echo’s opt‑in Decompress middleware allows a gzip‑compressed request to expand without any upper bound. A small compressed payload can grow into a massive body when parsed by a handler, consuming excessive memory or CPU. This uncontrolled resource consumption can lead to application slowdown or crash, directly resulting in denial of service.

The vulnerability exists in labstack Echo version 4.0.0 through 4.16.1. Any deployment of Echo v4 within that range that has the Decompress middleware enabled is susceptible.

The CVSS score of 8.2 indicates a high severity, yet the EPSS score is unavailable, making it unclear how frequently this flaw is targeted. The flaw is not catalogued in CISA KEV. An attacker can trigger the issue by sending a specially crafted HTTP request bearing a gzip Content‑Encoding header and a compressed body that, once decompressed, exceeds normal limits. Because the middleware is opt‑in, a vulnerable system must have it enabled for exploitation to succeed; disabling the middleware eliminates the risk.