Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete request bodies into memory before handlers run and retains complete response bodies for the dump callback without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large bodies or influence large responses, causing repeated or concurrent allocations that exhaust process memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure but do not bound response capture. This issue is fixed in 4.16.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete     request bodies into memory before handlers run and retains complete response bodies for the dump callback     without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large     bodies or influence large responses, causing repeated or concurrent allocations that exhaust process     memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure     but do not bound response capture. This issue is fixed in 4.16.1. (CVE-2026-118260)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in BodyDump middleware reads complete
    request bodies into memory before handlers run and retains complete response bodies for the dump callback
    without capture limits. An unauthenticated client that can reach a route using BodyDump can submit large
    bodies or influence large responses, causing repeated or concurrent allocations that exhaust process
    memory. BodyDump is not enabled by default, and external request limits may reduce request-side exposure
    but do not bound response capture. This issue is fixed in 4.16.1. (CVE-2026-118260)

ID	Name	Product	Family	Type	Severity
373459	Linux Distros Unpatched Vulnerability : CVE-2026-118260	Nessus	Misc.	Local	high
477237	SCA: security update for github.com/labstack/echo/v4 (GHSA-f48p-c9v4-h7xv)	Tenable Cloud Security	SCA Checks	Local	high
477237	SCA: security update for github.com/labstack/echo/v4 (GHSA-f48p-c9v4-h7xv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-118260

high

Tenable Plugins

high

high

high