News KrakenD EE 2.13.10 update released

CVE-2026-56864 CVE Low False Positive

x/mod/sumdb: Module Content Injection via Colluding GOPROXY and GOSUMDB

This advisory does not affect KrakenD

golang.org/x/mod/sumdb is only exercised by the go command when resolving module dependencies against a checksum database, a build-time operation. KrakenD’s runtime binary does not fetch, verify, or resolve Go modules, so it never calls into the vulnerable GOSUMDB client code.

Component

Go extended library (x/mod/sumdb)

Disclosed

Aug 14, 2026

Description

A malicious GOSUMDB could serve arbitrary module content that was never recorded in the transparency log, and a coordinating GOPROXY could then deliver that unverifiable content to a Go client. Because the checksum database and the transparency log are both under attacker control in this scenario, evaluating the log alone cannot detect the substitution. The issue is fixed in golang.org/x/mod/sumdb. This does not affect KrakenD, which never queries a GOSUMDB or GOPROXY at runtime.

References

View CVE-2026-56864 on NVD

Stay up to date with KrakenD releases and important updates