News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway News KrakenD CE v3.0 Released

CVE-2026-42501 CVE Medium False Positive

cmd/go: Malicious Module Proxy Can Bypass Checksum Database

This advisory does not affect KrakenD

This is a build-time vulnerability in the Go build tool (cmd/go). KrakenD distributes pre-compiled binaries and does not invoke go build or go get at runtime. End users running KrakenD as a gateway are not affected.

Addressed through routine dependency maintenance in CE 2.13.5 and EE 2.13.3.

Component

Go standard library (cmd/go)

Disclosed

May 11, 2026

Description

Go’s cmd/go build tool can be made to bypass the checksum database when a malicious module proxy manipulates the module download flow. This could allow a compromised proxy to serve unverified module content during a go get or build operation.

References

View CVE-2026-42501 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates