News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2026-32283 CVE High · CVSS 7.5 High Impact

crypto/tls: TLS Connection Deadlock via Key Update Flood

Exploitable

This vulnerability is exploitable in typical deployments. Upgrade to the fixed version as soon as possible.

Component

Go standard library (crypto/tls)

Disclosed

Apr 8, 2026

CVSS Score

7.5

Description

Go’s crypto/tls package can enter a permanent deadlock when a TLS peer sends multiple consecutive key update handshake messages. An attacker who can establish a TLS connection to the server can trigger this condition, causing the connection handler goroutine to stall indefinitely. Under sustained attack, this exhausts available goroutines and file descriptors, resulting in denial of service.

Version summary

Community Edition

2.13.4

addresses this advisory

Affected CE versions

>= 2.0, < 2.13.4

Enterprise Edition

2.13.2

addresses this advisory

Affected EE versions

>= 2.0, < 2.13.2

Upgrade to the addressed version or later to remediate this vulnerability.

Stay up to date with KrakenD releases and important updates