News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-39835 CVE Medium False Positive

ssh: Server Panic When CertChecker Has No Authority Callbacks

This advisory does not affect KrakenD

KrakenD does not implement or expose SSH functionality. The golang.org/x/crypto/ssh package is a transitive dependency but its SSH server code paths are never invoked during KrakenD operation. The dependency was upgraded as a precaution.

Addressed through routine dependency maintenance in CE 2.13.6 and EE 2.13.4.

Component

golang.org/x/crypto (SSH)

Disclosed

May 26, 2026

Description

Go’s golang.org/x/crypto/ssh server panics during CheckHostKey or Authenticate calls when the CertChecker is configured without authority verification callbacks. An attacker can trigger this crash by presenting a certificate during authentication.

References

View CVE-2026-39835 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates