News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2025-58187 CVE High · CVSS 7.5 Medium Impact

crypto/x509: Name Constraint Validation Denial of Service via Quadratic Complexity

Exploitable under specific conditions

This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

Affects deployments where KrakenD validates TLS certificates from backends or clients that include name constraint extensions. Any TLS connection involving such certificates can trigger the quadratic processing path.

Component

Go standard library (crypto/x509)

Disclosed

Oct 8, 2025

CVSS Score

7.5

Description

The name constraint checking algorithm in Go’s crypto/x509 package has non-linear processing time for certain certificate inputs. Programs that validate arbitrary certificate chains — including those performing TLS verification against backends — can be forced into excessive CPU consumption by a certificate with carefully crafted name constraints. Fixed in Go 1.24.8 and Go 1.25.2. A follow-up fix addressing TLS validation failures for FQDNs with a trailing dot was released in CE 2.11.2 and EE 2.11.3.

Version summary

Community Edition

2.11.1

addresses this advisory

Affected CE versions

>= 2.0, < 2.11.1

Enterprise Edition

2.11.2

addresses this advisory

Affected EE versions

>= 2.0, < 2.11.2

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2025-58187 on NVD

Stay up to date with KrakenD releases and important updates