html: XSS via Duplicate Attributes Causing Mis-parsing

This CVE does not affect KrakenD

KrakenD is an API gateway and does not use golang.org/x/net/html to parse or render HTML content from user requests. The vulnerable HTML parsing code path is never invoked during KrakenD operation.

Addressed through routine dependency maintenance in CE 2.13.6 and EE 2.13.4.

Component

golang.org/x/net (html)

Disclosed

May 26, 2026

Description

Go’s golang.org/x/net/html package incorrectly handles elements with duplicate attributes, causing mis-parsing of the HTML structure and potentially enabling cross-site scripting in applications that sanitize HTML using this package.

References

View CVE-2026-27136 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates