News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released
KrakenD played a vital role in our API transformation journey by protecting our business platforms boundary and exposing the business capabilities in a standard way to both internal and external audience.
Stefano Leopizzi
Enterprise Architecture / lastminute.com
CVE-2026-39820
CVE
Medium
False Positivenet/mail
formatted headers at runtime. The net/mail package is a transitive dependency
but its parsing functions are never invoked during KrakenD operation.Addressed through routine dependency maintenance in CE 2.13.5 and EE 2.13.3.
Component
Go standard library (net/mail)
Disclosed
May 11, 2026
net/mail package performs quadratic string concatenation inside the
consumeComment function when processing comment tokens within certain mail
header values. A crafted comment in an email header can cause excessive CPU
and memory consumption, leading to denial of service.Stay up to date with KrakenD releases and important updates