encoding/asn1: Memory Exhaustion via Malicious DER Payload

Exploitable under specific conditions

This CVE can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

Affects any deployment where KrakenD performs TLS certificate validation — either validating backend TLS certificates or accepting mTLS client certificates. A crafted certificate presented during TLS handshake can exhaust memory.

Component

Go standard library (encoding/asn1)

Disclosed

Oct 8, 2025

CVSS Score

5.3

Description

Parsing a maliciously crafted DER payload in Go’s encoding/asn1 package causes large upfront memory allocation, leading to memory exhaustion. DER encoding is used pervasively in TLS certificate parsing. A network-accessible attacker can trigger this by presenting a crafted certificate during TLS handshake. Fixed in Go 1.24.8 and Go 1.25.2.

Version summary

Community Edition

2.11.1

addresses this CVE

Affected CE versions

>= 2.0, < 2.11.1

Enterprise Edition

2.11.2

addresses this CVE

Affected EE versions

>= 2.0, < 2.11.2

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2025-58185 on NVD

Stay up to date with KrakenD releases and important updates