News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2026-39827 CVE Medium False Positive

ssh: Memory Leak via Repeatedly Rejected Channels Enables Server DoS

This advisory does not affect KrakenD

KrakenD does not implement or expose SSH functionality. The golang.org/x/crypto/ssh package is a transitive dependency but its SSH server code paths are never invoked during KrakenD operation. The dependency was upgraded as a precaution.

Addressed through routine dependency maintenance in CE 2.13.6 and EE 2.13.4.

Component

golang.org/x/crypto (SSH)

Disclosed

May 26, 2026

Description

Go’s golang.org/x/crypto/ssh server leaks memory when an authenticated client repeatedly opens and has channels rejected. Over time, this accumulated memory leak can exhaust server resources, leading to denial of service.

References

View CVE-2026-39827 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates