CVE-2026-46600
CVE
High
· CVSS 7.5
False Positivex/net/dns/dnsmessage: Panic via Malformed SVCB/HTTPS Resource Record
This advisory does not affect KrakenD
KrakenD’s outbound DNS resolution, used to resolve backend hostnames, relies on the
operating system’s standard resolver requesting A and AAAA records. It never issues
SVCB or HTTPS resource record queries, which are used for service binding to newer
QUIC/HTTP-3 endpoints. With no SVCB/HTTPS queries made, the vulnerable parsing path
in
dnsmessage is never exercised by KrakenD.Addressed through routine dependency maintenance in CE 2.13.9 and EE 2.13.7.
Component
Go extended library (x/net/dns/dnsmessage)
Disclosed
Aug 14, 2026
CVSS Score
7.5
Description
Go’s DNS message parser in
golang.org/x/net/dns/dnsmessage could panic when
decoding an invalid SVCB or HTTPS resource record whose parameter value size
overflowed the message buffer. A malicious or compromised DNS server returning such
a crafted record could crash the process performing the lookup. The fix adds bounds
checking before reading the parameter value.
This does not affect KrakenD, which never issues SVCB/HTTPS DNS queries.