BDSA-2026-37952
BDSA
Medium
False Positivex/text: Excessive Resource Consumption in Punycode Encoding of Long Invalid Hostnames
This advisory does not affect KrakenD
The
x/text punycode code referenced by this advisory lives in an internal package
that is not compiled into the KrakenD binary, so the vulnerable code is not present.No CVE identifier has been assigned to this vulnerability, so KrakenD tracks it by its BDSA identifier.
Component
Go extended library (x/text)
Disclosed
Nov 4, 2026
Description
The punycode encoding code in Go’s
golang.org/x/text module consumes excessive CPU
and memory when it encodes a long, invalid hostname. An attacker who controls the
hostname being encoded could degrade the performance of the process. This does not
affect KrakenD.