News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway
KrakenD played a vital role in our API transformation journey by protecting our business platforms boundary and exposing the business capabilities in a standard way to both internal and external audience.
Stefano Leopizzi
Enterprise Architecture / lastminute.com
CVE-2026-42504
CVE
High
· CVSS 7.5
Low ImpactExploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.
Component
Go standard library (mime)
Disclosed
Jun 3, 2026
CVSS Score
7.5
mime package WordDecoder.DecodeHeader function processes RFC 2047-encoded words
in MIME headers. Decoding a maliciously-crafted MIME header containing many invalid
encoded-words could consume excessive CPU, leading to denial of service. The MIME decoder
was updated to better handle this case.
KrakenD can receive such crafted headers from clients sending multipart requests or
via backend HTTP responses, making this potentially exploitable in proxied deployments.Community Edition
2.13.7
addresses this advisory
Affected CE versions
>= 2.0, < 2.13.7
Enterprise Edition
2.13.5
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.5
Upgrade to the addressed version or later to remediate this vulnerability.
Stay up to date with KrakenD releases and important updates