News KrakenD CE 2.13.9 and EE 2.13.7 update released

CVE-2026-56860 High High Impact

net/url: Quadratic Complexity in resolvePath During URL Resolution

Exploitable

This CVE is exploitable in typical deployments. Upgrade to the fixed version as soon as possible.

Component

Go standard library (net/url)

Disclosed

Aug 14, 2026

Description

Go’s net/url package resolved relative paths containing .. segments by repeatedly converting to and rewriting a string buffer at each step, giving the algorithm quadratic time complexity and high memory overhead for pathological inputs. A URL or request path with many .. segments could make URL.Parse and URL.ResolveReference consume disproportionate CPU and memory. The fix reworks resolvePath to use index-based backtracking over a byte buffer instead.

Version summary

Community Edition

2.13.9

addresses this CVE

Affected CE versions

>= 2.0, < 2.13.9

Enterprise Edition

2.13.7

addresses this CVE

Affected EE versions

>= 2.0, < 2.13.7

Upgrade to the addressed version or later to remediate this vulnerability.

Stay up to date with KrakenD releases and important updates