News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-46603 CVE High · CVSS 7.5 False Positive

x/image/vp8l: Excessive Memory Allocation via Unused Huffman Tree Groups

This advisory does not affect KrakenD

KrakenD Community Edition does not depend on golang.org/x/image. KrakenD Enterprise links the WebP decoder indirectly through the embeddings library used by the semantic cache (ai/semantic-cache), which registers WebP support for its image pipelines. KrakenD only uses the text feature extraction pipeline of that library to vectorize prompts; the image loading functions that call the decoder are never invoked, and no other KrakenD component decodes images. Request and response bodies, including image payloads, are proxied as raw bytes and never parsed by the VP8L decoder.

Component

Go extended library (x/image/vp8l)

Disclosed

Aug 14, 2026

CVSS Score

7.5

Description

The VP8L (lossless WebP) decoder in golang.org/x/image/vp8l could allocate excessive memory when processing a crafted image declaring many unused Huffman tree groups. A remote attacker able to submit such an image to an application that decodes it could cause a denial of service through memory exhaustion. The issue is fixed in golang.org/x/image v0.45.0. This does not affect KrakenD, which never decodes images received from clients or backends.

References

View CVE-2026-46603 on NVD View CVE-2026-46603 on Go Issue Tracker

Stay up to date with KrakenD releases and important updates