Echo v5's BodyDump middleware had a vulnerability where it could discard BodyLimit overflow errors for unknown-length requests, such as HTTP/1.1 chunked requests, when the BodyDump capture limit was below the BodyLimit threshold. This allowed a conditional size-policy bypass where a truncated request body could be processed successfully despite exceeding the configured limit. The issue affects all Echo v5 versions from 5.0.0 through 5.4.0. The vulnerability is fixed in version 5.4.1, which changes BodyDump to capture only the configured prefix and properly preserve read errors. Workarounds include disabling BodyDump on affected routes or setting the capture limit above the enforced body limit. No general authentication bypass, data modification, or denial of service is claimed.