Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a     gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into     a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing     repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and     limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.
    (CVE-2026-118261)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in Decompress middleware exposes a
    gzip-decoded request stream without limiting its expanded size. A small compressed request can expand into
    a very large body when a handler reads or binds it, consuming excessive memory or CPU and allowing
    repeated or concurrent requests to cause denial of service. The middleware is not enabled by default, and
    limiting only the compressed request size does not bound the decoded size. This issue is fixed in 4.16.1.
    (CVE-2026-118261)

ID	Name	Product	Family	Type	Severity
373451	Linux Distros Unpatched Vulnerability : CVE-2026-118261	Nessus	Misc.	Local	high
477262	SCA: security update for github.com/labstack/echo/v4 (GHSA-h7wr-284f-5qvc)	Tenable Cloud Security	SCA Checks	Local	high
477262	SCA: security update for github.com/labstack/echo/v4 (GHSA-h7wr-284f-5qvc)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-118261

high

Tenable Plugins

high

high

high