Case Study How Showpo Rebuilt Its API Layer for a Global Headless Migration

CVE-2025-58189 Medium · CVSS 5.3 Medium Impact

crypto/tls: Attacker-Controlled Text in ALPN Negotiation Error

Exploitable under specific conditions

This CVE can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

Affects any TLS-terminating KrakenD deployment. An attacker initiating a TLS connection with crafted ALPN values can inject arbitrary text into TLS handshake error messages logged by KrakenD.

Component

Go standard library (crypto/tls)

Disclosed

Oct 8, 2025

CVSS Score

5.3

Description

When a TLS handshake fails during ALPN protocol negotiation, Go’s crypto/tls package includes the client-supplied ALPN protocol list verbatim in the error message without escaping. An attacker can inject arbitrary text into TLS error logs by sending crafted ALPN values during the handshake. Fixed in Go 1.24.8 and Go 1.25.2.

Version summary

Community Edition

2.11.1

addresses this CVE

Affected CE versions

>= 2.0, < 2.11.1

Enterprise Edition

2.11.2

addresses this CVE

Affected EE versions

>= 2.0, < 2.11.2

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2025-58189 on NVD

Stay up to date with KrakenD releases and important updates