KrakenD EE 2.13.10 update released

This patch release of KrakenD Enterprise Edition upgrades the grpc dependency to address CVE-2026-84445, a denial of service in gRPC-Go servers that route requests through xDS. A request carrying neither :authority nor Host makes the xDS routing interceptor panic, and the panic takes down the whole server process.

KrakenD does not consume xDS: the Enterprise gRPC server resolves methods from its own catalog and never registers that interceptor, so the crash is unreachable and the CVE is a false positive for the gateway. We ship the upgraded dependency anyway so that vulnerability scanners inspecting the binary come back clean, and we recommend upgrading for that reason alone.

Check our security advisories page for more details on how each CVE affects KrakenD.