We began by creating a model with the community version to assess its capabilities. Once we confirmed that this tool met our needs, we opted for an enterprise license. Simply to benefit from tools that facilitate integration into our model and address specific requirements of our architecture in terms of security, data transformation, and authentication management.
Nicolas Gabetty
Senior Engineer / Coop Atlantique
CVE-2026-56859
High
Medium ImpactThis CVE can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.
Component
Go standard library (encoding/xml)
Disclosed
Aug 14, 2026
encoding/xml package reset its recursion depth counter inside
Decoder.DecodeElement, so the guard meant to stop deeply nested XML documents from
recursing indefinitely never actually fired. A crafted XML document with many nested
elements could drive the decoder into unbounded recursion, exhausting the goroutine’s
stack and crashing the process. The fix restores the depth counter so it persists
across nested DecodeElement calls.Community Edition
2.13.9
addresses this CVE
Affected CE versions
>= 2.0, < 2.13.9
Enterprise Edition
2.13.7
addresses this CVE
Affected EE versions
>= 2.0, < 2.13.7
Upgrade to the addressed version or later to remediate this vulnerability.
Stay up to date with KrakenD releases and important updates