News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.2, EE 3.0.2 and EE 2.13.12 Update Released News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy

CVE-2026-100347 CVE Medium · CVSS 5.3 False Positive

kin-openapi: Panic in Legacy Router via Non-Canonical HTTP Method on a Static Path

This advisory does not affect KrakenD

The panic requires routing incoming requests through openapi3filter.ValidationHandler and the kin-openapi legacy router. KrakenD Enterprise uses kin-openapi only to load and translate OpenAPI documents in the krakend openapi commands, and KrakenD routes requests with its own router. KrakenD Community does not include kin-openapi.

Addressed through routine dependency maintenance in EE 3.0.2, 2.13.12.

Component

kin-openapi (openapi3filter)

Disclosed

Oct 20, 2026

CVSS Score

5.3

Description

Before kin-openapi 0.145.0, openapi3filter.ValidationHandler uses the legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to PathItem.GetOperation. The default branch of that function panics before authentication runs, so an unauthenticated client can repeatedly send methods such as PROPFIND or a lowercase get to abort connections and flood the logs with stack traces.

References

View CVE-2026-100347 on NVD View CVE-2026-100347 on GitHub Advisory Database

Stay up to date with KrakenD releases and important updates