News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2026-42499 CVE Medium False Positive

net/mail: Quadratic String Concatenation in consumePhrase

This advisory does not affect KrakenD

KrakenD is an API gateway and does not parse email messages or net/mail formatted headers at runtime. The net/mail package is a transitive dependency but its parsing functions are never invoked during KrakenD operation.

Addressed through routine dependency maintenance in CE 2.13.5 and EE 2.13.3.

Component

Go standard library (net/mail)

Disclosed

May 11, 2026

Description

Go’s net/mail package performs quadratic string concatenation inside the consumePhrase function when parsing certain mail header values. A crafted email header phrase can cause the parser to consume an excessive amount of CPU and memory, leading to denial of service.

References

View CVE-2026-42499 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates