News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released
Flexibility, performance and robustness are defining KrakenD just to name a few, we were able to quickly and easily build a robust gateway for our systems and we keep enjoying it everyday.
Samy Lastmann
CTO / Smart Tribune
CVE-2026-27136
CVE
Medium
False Positivegolang.org/x/net/html to parse or
render HTML content from user requests. The vulnerable HTML parsing code path is
never invoked during KrakenD operation.Addressed through routine dependency maintenance in CE 2.13.6 and EE 2.13.4.
Component
golang.org/x/net (html)
Disclosed
May 26, 2026
golang.org/x/net/html package incorrectly handles elements with duplicate
attributes, causing mis-parsing of the HTML structure and potentially enabling
cross-site scripting in applications that sanitize HTML using this package.Stay up to date with KrakenD releases and important updates