News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway
It must be mentioned again how speedy KrakenD folks are to responding and how helpful it is. It feels like we're working with a team that works here in Paylocity
Dannie Walker
Senior Software Engineer / Paylocity
CVE-2025-58186
CVE
Medium
· CVSS 5.3
High ImpactThis vulnerability is exploitable in typical deployments. Upgrade to the fixed version as soon as possible.
Component
Go standard library (net/http)
Disclosed
Oct 8, 2025
CVSS Score
5.3
net/http package does not limit the number of cookies it parses from an
HTTP request, despite the 1 MB header size limit. An attacker can send a request
containing a large number of minimal cookies (e.g. a=;) to cause the server to
allocate a large number of cookie structs, exhausting memory. Fixed in Go 1.24.8
and Go 1.25.2.Community Edition
2.11.1
addresses this advisory
Affected CE versions
>= 2.0, < 2.11.1
Enterprise Edition
2.11.2
addresses this advisory
Affected EE versions
>= 2.0, < 2.11.2
Upgrade to the addressed version or later to remediate this vulnerability.
Stay up to date with KrakenD releases and important updates