News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2025-61728 CVE Medium · CVSS 5.3 False Positive

archive/zip: Super-linear Filename Indexing Causes DoS on Malicious ZIPs

This advisory does not affect KrakenD

KrakenD does not parse ZIP archives at runtime. The archive/zip package is not used in KrakenD’s request processing pipeline. This CVE does not affect KrakenD deployments.

Addressed through routine dependency maintenance in CE 2.12.1 and EE 2.12.3.

Component

Go standard library (archive/zip)

Disclosed

Jan 16, 2026

CVSS Score

5.3

Description

Go’s archive/zip package builds an internal filename index over all entries in a ZIP archive. A specially crafted ZIP with a pathological number of similarly named entries can cause this indexing operation to exhibit super-linear (quadratic) time complexity, leading to denial of service when parsing such an archive.

References

View CVE-2025-61728 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates