Case Study How Showpo Rebuilt Its API Layer for a Global Headless Migration

CVE-2025-61723 High · CVSS 7.5 Low Impact

encoding/pem: Denial of Service via Quadratic Complexity on Invalid PEM Input

Limited exploitability

Exploiting this CVE requires an uncommon setup or configuration. Upgrading is still recommended when possible.

KrakenD parses PEM-encoded certificates and keys from configuration files at startup, not from runtime user input. Exploitation requires an attacker able to influence PEM data loaded during startup, such as through a misconfigured dynamic configuration source.

Component

Go standard library (encoding/pem)

Disclosed

Oct 8, 2025

CVSS Score

7.5

Description

Go’s encoding/pem package exhibits non-linear processing time when parsing certain invalid PEM inputs. Programs that parse untrusted PEM data can be driven into excessive CPU consumption, causing a denial of service. Fixed in Go 1.24.8 and Go 1.25.2.

Version summary

Community Edition

2.11.1

addresses this CVE

Affected CE versions

>= 2.0, < 2.11.1

Enterprise Edition

2.11.2

addresses this CVE

Affected EE versions

>= 2.0, < 2.11.2

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2025-61723 on NVD

Stay up to date with KrakenD releases and important updates