KrakenD CE 2.13.9 and EE 2.13.7 update released
by Daniel Ortiz
This patch release of KrakenD Community Edition and Enterprise Edition upgrades Go to 1.25.13 to address several disclosed CVEs. Check our security advisories page for more details:
- CVE-2026-56865
- CVE-2026-56864
- CVE-2026-56859
- CVE-2026-56853
- CVE-2026-56860
- CVE-2026-46600
- CVE-2026-56862
- CVE-2026-56858
- CVE-2026-39821
- CVE-2026-33818
It also adresses an OpenTelemtry and a grpc vulnerabilities:
🚀 Summary of changes for EEv2.13.7 (patch)
Recommended security upgrade addressing several vulnerabilities by the Go team
- Upgraded Go to 1.25.13, addressing several CVEs with discloded descriptions:
- CVE-2026-56865
x/mod/sumdb/tlog: fix transparency log tile verification bypass (false positive) - CVE-2026-56864
x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (false positive) - CVE-2026-56859
encoding/xml: add recursion depth guard during decode - CVE-2026-56853
net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check - CVE-2026-56860
net/url: avoid quadratic complexity in resolvePath - CVE-2026-46600
golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record (false posivite) - CVE-2026-56862
crypto/tls: limit handshake messages we are willing to accept post-handshake - CVE-2026-56858
html/template: fix Javascript regexp context tracking (false positive) - CVE-2026-39821
x/net/idna: failure to reject ASCII-only Punycode-encoded labels - CVE-2026-33818
encoding/asn1: enforce maximum recursion depth
- CVE-2026-56865
- Upgraded Opentelemetry addressing CVE-2026-41178
- Upgraded google.golang.org/grpc adressing GHSA-hrxh-6v49-42gf
Upgrading to the latest version is always advised.
🚀 Summary of changes for CEv2.13.9 (patch)
Recommended security upgrade addressing several vulnerabilities by the Go team
- Upgraded Go to 1.25.13, addressing several CVEs with discloded descriptions:
- CVE-2026-56865
x/mod/sumdb/tlog: fix transparency log tile verification bypass (false positive) - CVE-2026-56864
x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup (false positive) - CVE-2026-56859
encoding/xml: add recursion depth guard during decode - CVE-2026-56853
net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check - CVE-2026-56860
net/url: avoid quadratic complexity in resolvePath - CVE-2026-46600
golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record (false posivite) - CVE-2026-56862
crypto/tls: limit handshake messages we are willing to accept post-handshake - CVE-2026-56858
html/template: fix Javascript regexp context tracking (false positive) - CVE-2026-39821
x/net/idna: failure to reject ASCII-only Punycode-encoded labels - CVE-2026-33818
encoding/asn1: enforce maximum recursion depth
- CVE-2026-56865
- Upgraded Opentelemetry addressing CVE-2026-41178
- Upgraded google.golang.org/grpc adressing GHSA-hrxh-6v49-42gf
Upgrading to the latest version is always advised.
Categories:
Product UpdatesSecurity