News KrakenD CE 2.13.7 and EE 2.13.5 update released

CVE-2026-42507 Medium Medium Impact

net/textproto: Log Injection via Unescaped Input in Error Messages

Exploitable under specific conditions

This CVE can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

A malicious backend server can send HTTP response headers containing arbitrary unescaped content that will appear in KrakenD’s error logs or output. Deployments that proxy to untrusted or partially trusted upstream services are most exposed.

Component

Go standard library (net/textproto)

Disclosed

Jun 3, 2026

Description

Go’s net/textproto package included raw user-controlled input in error messages without any escaping. The net/http client uses ReadMIMEHeader to parse response headers from servers, so a malicious backend server can inject arbitrary content — including terminal control bytes — into KrakenD’s error output or logs. This can lead to log injection, log spoofing, or manipulation of log-based monitoring systems.

Version summary

Community Edition

2.13.7

addresses this CVE

Affected CE versions

>= 2.0, < 2.13.7

Enterprise Edition

2.13.5

addresses this CVE

Affected EE versions

>= 2.0, < 2.13.5

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-42507 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates