News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-42507 CVE Medium · CVSS 5.3 Medium Impact

net/textproto: Log Injection via Unescaped Input in Error Messages

Exploitable under specific conditions

This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

A malicious backend server can send HTTP response headers containing arbitrary unescaped content that will appear in KrakenD’s error logs or output. Deployments that proxy to untrusted or partially trusted upstream services are most exposed.

Component

Go standard library (net/textproto)

Disclosed

Jun 3, 2026

CVSS Score

5.3

Description

Go’s net/textproto package included raw user-controlled input in error messages without any escaping. The net/http client uses ReadMIMEHeader to parse response headers from servers, so a malicious backend server can inject arbitrary content — including terminal control bytes — into KrakenD’s error output or logs. This can lead to log injection, log spoofing, or manipulation of log-based monitoring systems.

Version summary

Community Edition

2.13.7

addresses this advisory

Affected CE versions

>= 2.0, < 2.13.7

Enterprise Edition

2.13.5

addresses this advisory

Affected EE versions

>= 2.0, < 2.13.5

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-42507 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates