News KrakenD Partners with Digital Platform Solutions to Expand Reach in Pakistan

CVE-2025-61732 Medium · CVSS 6.3 False Positive

cmd/cgo: Code Smuggling into cgo Binary via Comment Parsing

This CVE does not affect KrakenD

KrakenD ships pre-compiled, statically linked binaries. Users never supply Go source files to KrakenD and the Go toolchain is not invoked at runtime. The attack vector requires the ability to submit malicious Go source code to a cgo build pipeline, which is not part of KrakenD’s operation.

Addressed through routine dependency maintenance in CE 2.13.0 and EE 2.12.4.

Component

Go standard library (cmd/cgo)

Disclosed

Feb 10, 2026

CVSS Score

6.3

Description

A discrepancy between how Go and C/C++ parse block comments (/* ... */) allowed an attacker to craft a Go source file that embeds arbitrary C code into the resulting cgo binary. The injected C code would not be visible when reading the Go source but would be compiled and executed as part of the final binary, enabling supply-chain attacks against projects that accept external Go source contributions.

Stay up to date with KrakenD releases and important updates