News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2025-61723 CVE High · CVSS 7.5 Low Impact

encoding/pem: Denial of Service via Quadratic Complexity on Invalid PEM Input

Limited exploitability

Exploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.

KrakenD parses PEM-encoded certificates and keys from configuration files at startup, not from runtime user input. Exploitation requires an attacker able to influence PEM data loaded during startup, such as through a misconfigured dynamic configuration source.

Component

Go standard library (encoding/pem)

Disclosed

Oct 8, 2025

CVSS Score

7.5

Description

Go’s encoding/pem package exhibits non-linear processing time when parsing certain invalid PEM inputs. Programs that parse untrusted PEM data can be driven into excessive CPU consumption, causing a denial of service. Fixed in Go 1.24.8 and Go 1.25.2.

Version summary

Community Edition

2.11.1

addresses this advisory

Affected CE versions

>= 2.0, < 2.11.1

Enterprise Edition

2.11.2

addresses this advisory

Affected EE versions

>= 2.0, < 2.11.2

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2025-61723 on NVD

Stay up to date with KrakenD releases and important updates