Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-33811 CVE High · CVSS 7.5 Low Impact

net: Application Crash via Long CNAME DNS Response

Limited exploitability

Exploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.

KrakenD resolves backend hostnames via DNS before establishing connections. Exploitation requires the ability to influence DNS responses seen by the KrakenD instance — via a compromised DNS server, cache poisoning, or a malicious backend hostname under attacker control. Deployments using only static IP addresses for backends are not affected.

Component

Go standard library (net)

Disclosed

May 11, 2026

CVSS Score

7.5

Description

When using Go’s LookupCNAME function with the cgo-based DNS resolver, an unusually long CNAME response triggers a double-free of C memory and crashes the Go process. An attacker able to influence DNS responses seen by KrakenD — via a malicious DNS server, DNS cache poisoning, or a compromised upstream resolver — can crash KrakenD by causing it to resolve a hostname with a crafted CNAME chain.

Version summary

Community Edition

2.13.5

addresses this advisory

Affected CE versions

>= 2.0, < 2.13.5

Enterprise Edition

2.13.3

addresses this advisory

Affected EE versions

>= 2.0, < 2.13.3

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-33811 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates