News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway
KrakenD allowed us to focus on our backend and deploy a secure and performant system in a few days. After more than 2 years of use in production and 0 crash or malfunction, it also has proven its robustness
Jonathan Muller
CTO / Openroom Inc.
CVE-2025-22874
CVE
High
· CVSS 7.5
Low ImpactExploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.
ExtKeyUsageAny in their certificate verification options, and only when the
peer certificate chain includes policy graph extensions — an uncommon combination.Component
Go standard library (crypto/x509)
Disclosed
Jun 19, 2025
CVSS Score
7.5
crypto/x509.Verify with a VerifyOptions.KeyUsages slice that contains
ExtKeyUsageAny unintentionally disables certificate policy graph validation.
Certificate chains that include policy extensions may be accepted when they should
be rejected based on their declared policies. The condition requires both an uncommon
certificate configuration (policy graphs) and the explicit use of ExtKeyUsageAny
in the TLS verification options. Fixed in Go 1.24.4.Community Edition
2.10.1
addresses this advisory
Affected CE versions
>= 2.0, < 2.10.1
Enterprise Edition
2.10.1
addresses this advisory
Affected EE versions
>= 2.0, < 2.10.1
Upgrade to the addressed version or later to remediate this vulnerability.
Stay up to date with KrakenD releases and important updates