News KrakenD CE 2.13.7 and EE 2.13.5 update released

CVE-2026-42504 Medium Low Impact

mime: Denial of Service via Quadratic Complexity in MIME Header Decoding

Limited exploitability

Exploiting this CVE requires an uncommon setup or configuration. Upgrading is still recommended when possible.

The vulnerability can be triggered by sending HTTP requests with maliciously-crafted MIME-encoded headers (RFC 2047 encoded-words). Deployments that proxy multipart form data or forward headers containing MIME-encoded values are most exposed.

Component

Go standard library (mime)

Disclosed

Jun 3, 2026

Description

Go’s mime package WordDecoder.DecodeHeader function processes RFC 2047-encoded words in MIME headers. Decoding a maliciously-crafted MIME header containing many invalid encoded-words could consume excessive CPU, leading to denial of service. The MIME decoder was updated to better handle this case. KrakenD can receive such crafted headers from clients sending multipart requests or via backend HTTP responses, making this potentially exploitable in proxied deployments.

Version summary

Community Edition

2.13.7

addresses this CVE

Affected CE versions

>= 2.0, < 2.13.7

Enterprise Edition

2.13.5

addresses this CVE

Affected EE versions

>= 2.0, < 2.13.5

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-42504 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates