News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2026-25681 CVE Medium False Positive

html: XSS via Incorrect Handling of Character References in DOCTYPE

This advisory does not affect KrakenD

KrakenD is an API gateway and does not use golang.org/x/net/html to parse or render HTML content from user requests. The vulnerable HTML parsing code path is never invoked during KrakenD operation.

Addressed through routine dependency maintenance in CE 2.13.6 and EE 2.13.4.

Component

golang.org/x/net (html)

Disclosed

May 26, 2026

Description

Go’s golang.org/x/net/html package incorrectly handles character references within DOCTYPE nodes, potentially allowing cross-site scripting through malformed DOCTYPE declarations in parsed HTML content.

References

View CVE-2026-25681 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates