CVE-2025-61728
Medium
· CVSS 5.3
False Positivearchive/zip package is not used
in KrakenD’s request processing pipeline. This CVE does not affect KrakenD deployments.Addressed through routine dependency maintenance in CE 2.12.1 and EE 2.12.3.
Component
Go standard library (archive/zip)
Disclosed
Jan 16, 2026
CVSS Score
5.3
archive/zip package builds an internal filename index over all entries in a ZIP
archive. A specially crafted ZIP with a pathological number of similarly named entries
can cause this indexing operation to exhibit super-linear (quadratic) time complexity,
leading to denial of service when parsing such an archive.Stay up to date with KrakenD releases and important updates