News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2025-61723 CVE High · CVSS 7.5 Low Impact

encoding/pem: Denial of Service via Quadratic Complexity on Invalid PEM Input

Limited exploitability

Exploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.

KrakenD parses PEM-encoded certificates and keys from configuration files at startup, not from runtime user input. Exploitation requires an attacker able to influence PEM data loaded during startup, such as through a misconfigured dynamic configuration source.

Component

Go standard library (encoding/pem)

Disclosed

Oct 8, 2025

CVSS Score

7.5

Description

Go’s encoding/pem package exhibits non-linear processing time when parsing certain invalid PEM inputs. Programs that parse untrusted PEM data can be driven into excessive CPU consumption, causing a denial of service. Fixed in Go 1.24.8 and Go 1.25.2.

Version summary

Community Edition

2.11.1

addresses this advisory

Affected CE versions

>= 2.0, < 2.11.1

Enterprise Edition

2.11.2

addresses this advisory

Affected EE versions

>= 2.0, < 2.11.2

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2025-61723 on NVD

Stay up to date with KrakenD releases and important updates