News KrakenD Partners with Digital Platform Solutions to Expand Reach in Pakistan

CVE-2026-32280 Medium · CVSS 5.3 Medium Impact

crypto/x509: Unexpected Work During Certificate Chain Building

Exploitable under specific conditions

This CVE can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

KrakenD validates X.509 certificates during TLS handshakes. Deployments with mutual TLS (mTLS) configured are most exposed, as a connecting client can present a crafted certificate. Backend connections using TLS certificate verification are also affected if the backend serves a crafted certificate chain.

Component

Go standard library (crypto/x509)

Disclosed

Apr 8, 2026

CVSS Score

5.3

Description

Go’s crypto/x509 package performs an unexpectedly large amount of work when building certain certificate chains for validation. A specially crafted certificate or certificate chain presented during a TLS handshake can cause the server to spend disproportionate CPU time on chain construction, potentially leading to denial of service.

Version summary

Community Edition

2.13.4

addresses this CVE

Affected CE versions

>= 2.0, < 2.13.4

Enterprise Edition

2.13.2

addresses this CVE

Affected EE versions

>= 2.0, < 2.13.2

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-32280 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates