Flexibility, performance and robustness are defining KrakenD just to name a few, we were able to quickly and easily build a robust gateway for our systems and we keep enjoying it everyday.
Samy Lastmann
CTO / Smart Tribune
CVE-2026-42499
Medium
False Positivenet/mail
formatted headers at runtime. The net/mail package is a transitive dependency
but its parsing functions are never invoked during KrakenD operation.Addressed through routine dependency maintenance in CE 2.13.5 and EE 2.13.3.
Component
Go standard library (net/mail)
Disclosed
May 11, 2026
net/mail package performs quadratic string concatenation inside the
consumePhrase function when parsing certain mail header values. A crafted
email header phrase can cause the parser to consume an excessive amount of CPU
and memory, leading to denial of service.Stay up to date with KrakenD releases and important updates