News KrakenD Partners with Digital Platform Solutions to Expand Reach in Pakistan

CVE-2025-61728 Medium · CVSS 5.3 False Positive

archive/zip: Super-linear Filename Indexing Causes DoS on Malicious ZIPs

This CVE does not affect KrakenD

KrakenD does not parse ZIP archives at runtime. The archive/zip package is not used in KrakenD’s request processing pipeline. This CVE does not affect KrakenD deployments.

Addressed through routine dependency maintenance in CE 2.12.1 and EE 2.12.3.

Component

Go standard library (archive/zip)

Disclosed

Jan 16, 2026

CVSS Score

5.3

Description

Go’s archive/zip package builds an internal filename index over all entries in a ZIP archive. A specially crafted ZIP with a pathological number of similarly named entries can cause this indexing operation to exhibit super-linear (quadratic) time complexity, leading to denial of service when parsing such an archive.

Stay up to date with KrakenD releases and important updates