News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-107386 CVE Medium · CVSS 6.3 Low Impact

amqp: Memory Exhaustion via Oversized Frame Before Connection Tuning

Limited exploitability

Exploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.

Reachable only through the AMQP integrations, backend/amqp/consumer, backend/amqp/producer, and async agents using the AMQP driver. The attack has to come from the broker side while KrakenD opens the connection, so it requires a malicious or compromised broker, or an attacker able to intercept a plaintext AMQP connection. Deployments that do not connect to AMQP are not exposed.

Component

RabbitMQ AMQP 0-9-1 client for Go (amqp091-go)

Disclosed

Oct 13, 2026

CVSS Score

6.3

Description

amqp091-go 1.13.0 enforces the negotiated maximum frame size on incoming frames, but a frame size of zero means both “not negotiated yet” and “unlimited”. The frame reader starts before the connection.tune exchange, so during connection setup the check is skipped. A broker, or anyone controlling a plaintext AMQP connection, can send a 7-byte body frame header declaring a payload of up to 4 GiB, and the client allocates that buffer before any validation, an out-of-memory denial of service. This bypasses the fix for CVE-2026-79921 and is fixed in amqp091-go 1.14.0.

Version summary

Enterprise Edition

3.0.1, 2.13.11

addresses this advisory

Affected EE versions

>= 2.13.9, < 2.13.11 || >= 3.0, < 3.0.1

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-107386 on NVD View CVE-2026-107386 on GitHub Advisory Database

Stay up to date with KrakenD releases and important updates