KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released
by Jorge Tarrero
This patch release of KrakenD Community Edition and Enterprise Edition upgrades Go to 1.26.9 to address several disclosed CVEs in the standard library. We recommend upgrading for the security fixes alone. For 2.x users, Enterprise 2.13.11 backports the same security upgrades.
Security Upgrades
All three releases build with Go 1.26.9, which fixes CVEs in net/http, crypto/tls, html/template and other packages. The Enterprise releases also upgrade the amqp dependency to address CVE-2026-107386 and the otel dependency to address CVE-2026-81870.
Check our security advisories page for more details on how each CVE affects KrakenD.
Enterprise Improvements
KrakenD EE 3.0.1 no longer disables gzip compression across the gateway when WebSockets are present and makes the AI Router try the configured failover options when a provider call fails.
Most of the remaining fixes target the AI Gateway. They close a bypass in prompt guarding with escaped characters, stop the semantic cache from skipping prompt guards, and restore LLM metrics in streaming mode among other fixes.
The full list of changes for each version follows.
🚀 Summary of changes for EEv3.0.1 (patch)
Recommended security upgrade addressing several vulnerabilities and feature fixes
- Websockets no longer disable gzip compression for the rest of the gateway.
- The AI Router feature now properly tries the configured failover options if a provider call fails.
- Added AI LLM metrics generation when working in streaming mode.
-
Fixed a recoverable panic in the Circuit Breaker component when configured along with
telemetry/opentelemetry. - Fixed an issue in IP filter and GeoIP plugins where incorrect configurations could lead to unexpected behavior.
- Fixed an issue in AI semantic cache feature that could lead to unchecked prompt guards.
- Fixed a problem in AI prompt guarding feature that could lead to unexpected bypasses when dealing with escaped characters.
-
Fixed an issue in AI semantic cache
key_variantoption that provoked unexpected cache misses. - Fixed a shared state problem when generating Notdiamond model choices that provoked wrong requests.
- Fixed an issue generating Notdiamond model catalog on startup that could lead to missing choices.
- Fixed an unexpected panic with specific AI Router configuration settings.
-
Removed
auth/validatorWARNING log entry for missing optional config field. -
Upgraded
amqpdependency, addressing CVE-2026-107386 -
Upgraded
oteldependency, addressing CVE-2026-81870 - Upgraded Go to 1.26.9, addressing several CVEs with disclosed descriptions:
- CVE-2026-97032
net/http: HTTP/2 server crash due to HPACK encoder race - CVE-2026-78659
net/http: reject malformed ECH outer extension references - CVE-2026-97031
crypto/tls: reject malformed ECH outer extension references - CVE-2026-94444
cmd/go: checksum bypass for golang.org/fips140 - CVE-2026-94447
cmd/go: checksum database bypass for golang.org/toolchain - CVE-2026-94448
html/template: reset context tracking on consecutive template expressions - CVE-2026-97030
html/template: recognize yield as regexp preceder keyword - CVE-2026-94440
net/textproto, mime/multipart: memory limit bypass when parsing MIME headers - CVE-2026-56866
net/http: HTTP/1 client connection desynchronization after CONNECT rejection - CVE-2026-94439
net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response - CVE-2026-78669
net/http: excessive CPU consumption from repeated initial window changes - CVE-2026-78660
net/http: HTTP/2 transport accepts malformed framing-related headers - CVE-2026-56857
os: Root.Mkdir(All) can follow junctions out of the root on Windows - CVE-2026-78667
net/http: lack of limit on size of parsed Range headers - CVE-2026-78663
net/http: double flow control refund on HTTP/2 server streams
- CVE-2026-97032
Upgrading to the latest version is always advised.
🚀 Summary of changes for CEv3.0.1 (patch)
Recommended security upgrade addressing several vulnerabilities and feature fixes
-
Removed
auth/validatorWARNING log entry for missing optional config field. - Upgraded Go to 1.26.9, addressing several CVEs with disclosed descriptions:
- CVE-2026-97032
net/http: HTTP/2 server crash due to HPACK encoder race - CVE-2026-78659
net/http: reject malformed ECH outer extension references - CVE-2026-97031
crypto/tls: reject malformed ECH outer extension references - CVE-2026-94444
cmd/go: checksum bypass for golang.org/fips140 - CVE-2026-94447
cmd/go: checksum database bypass for golang.org/toolchain - CVE-2026-94448
html/template: reset context tracking on consecutive template expressions - CVE-2026-97030
html/template: recognize yield as regexp preceder keyword - CVE-2026-94440
net/textproto, mime/multipart: memory limit bypass when parsing MIME headers - CVE-2026-56866
net/http: HTTP/1 client connection desynchronization after CONNECT rejection - CVE-2026-94439
net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response - CVE-2026-78669
net/http: excessive CPU consumption from repeated initial window changes - CVE-2026-78660
net/http: HTTP/2 transport accepts malformed framing-related headers - CVE-2026-56857
os: Root.Mkdir(All) can follow junctions out of the root on Windows - CVE-2026-78667
net/http: lack of limit on size of parsed Range headers - CVE-2026-78663
net/http: double flow control refund on HTTP/2 server streams
- CVE-2026-97032
Upgrading to the latest version is always advised.
🚀 Summary of changes for EEv2.13.11 (patch)
Recommended security backport upgrades addressing several vulnerabilities
-
Upgraded
amqpdependency, addressing CVE-2026-107386. -
Upgraded
oteldependency, addressing CVE-2026-81870. - Upgraded Go to 1.26.9, addressing several CVEs with disclosed descriptions:
- CVE-2026-97032
net/http: HTTP/2 server crash due to HPACK encoder race - CVE-2026-78659
net/http: reject malformed ECH outer extension references - CVE-2026-97031
crypto/tls: reject malformed ECH outer extension references - CVE-2026-94444
cmd/go: checksum bypass for golang.org/fips140 - CVE-2026-94447
cmd/go: checksum database bypass for golang.org/toolchain - CVE-2026-94448
html/template: reset context tracking on consecutive template expressions - CVE-2026-97030
html/template: recognize yield as regexp preceder keyword - CVE-2026-94440
net/textproto, mime/multipart: memory limit bypass when parsing MIME headers - CVE-2026-56866
net/http: HTTP/1 client connection desynchronization after CONNECT rejection - CVE-2026-94439
net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response - CVE-2026-78669
net/http: excessive CPU consumption from repeated initial window changes - CVE-2026-78660
net/http: HTTP/2 transport accepts malformed framing-related headers - CVE-2026-56857
os: Root.Mkdir(All) can follow junctions out of the root on Windows - CVE-2026-78667
net/http: lack of limit on size of parsed Range headers - CVE-2026-78663
net/http: double flow control refund on HTTP/2 server streams
- CVE-2026-97032
Upgrading to the latest version is always advised.