Threats tagged 'ghsa-h7wr-284f-5qvc'

Echo v4's optional Decompress middleware for gzip requests allowed unbounded decompression size, enabling a small compressed request to expand into a very large body. This could cause excessive memory or CPU consumption, leading to denial of service. The middleware is not enabled by default. Versions prior to 4.16.1 are affected. The issue is fixed in Echo v4.16.1 by adding a configurable maximum decompressed size limit.