News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2025-61732 CVE Medium · CVSS 6.3 False Positive

cmd/cgo: Code Smuggling into cgo Binary via Comment Parsing

This advisory does not affect KrakenD

KrakenD ships pre-compiled, statically linked binaries. Users never supply Go source files to KrakenD and the Go toolchain is not invoked at runtime. The attack vector requires the ability to submit malicious Go source code to a cgo build pipeline, which is not part of KrakenD’s operation.

Addressed through routine dependency maintenance in CE 2.13.0 and EE 2.12.4.

Component

Go standard library (cmd/cgo)

Disclosed

Feb 10, 2026

CVSS Score

6.3

Description

A discrepancy between how Go and C/C++ parse block comments (/* ... */) allowed an attacker to craft a Go source file that embeds arbitrary C code into the resulting cgo binary. The injected C code would not be visible when reading the Go source but would be compiled and executed as part of the final binary, enabling supply-chain attacks against projects that accept external Go source contributions.

References

View CVE-2025-61732 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates