News KrakenD Partners with Digital Platform Solutions to Expand Reach in Pakistan

CVE-2025-61729 Medium · CVSS 5.3 Medium Impact

crypto/x509: Quadratic Runtime in HostnameError.Error via Malicious Certificate

Exploitable under specific conditions

This CVE can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

KrakenD performs TLS handshakes on both its listening ports and outbound backend connections. A malicious certificate with many hostnames presented during an inbound mTLS handshake or served by a backend can trigger this quadratic behaviour. Deployments with TLS enabled (especially mTLS) are most exposed.

Component

Go standard library (crypto/x509)

Disclosed

Dec 4, 2025

CVSS Score

5.3

Description

Go’s crypto/x509 package constructs hostname error strings using repeated string concatenation over an unbounded list of certificate hostnames. A malicious certificate with an extremely large number of hostnames can cause HostnameError.Error() to exhibit quadratic runtime, leading to excessive CPU and memory consumption and denial of service during TLS handshake processing.

Version summary

Community Edition

2.12.1

addresses this CVE

Affected CE versions

>= 2.0, < 2.12.1

Enterprise Edition

2.12.2

addresses this CVE

Affected EE versions

>= 2.0, < 2.12.2

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2025-61729 on NVD

Stay up to date with KrakenD releases and important updates