News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway
Flexibility, performance and robustness are defining KrakenD just to name a few, we were able to quickly and easily build a robust gateway for our systems and we keep enjoying it everyday.
Samy Lastmann
CTO / Smart Tribune
CVE-2026-56866
CVE
High
· CVSS 7.5
Low ImpactExploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.
"method": "CONNECT" that receives a request body
and rejects it with a keep-alive response. Endpoints cannot accept CONNECT, so the
request must come from an explicit backend setting, an unusual configuration.
Deployments that do not use CONNECT against their backends are not exposed.Component
Go standard library (net/http)
Disclosed
Oct 13, 2026
CVSS Score
7.5
Transport sent a CONNECT request with a non-empty body by writing the
body unframed right after the headers. When the server rejected the request with a
non-2xx keep-alive response, the connection returned to the idle pool while the server
could still parse the trailing body bytes as a pipelined request. The next request that
reused the connection then received the response to that injected request, poisoning
responses across users. The fix closes the connection after any CONNECT, and
httputil.ReverseProxy now answers CONNECT with 405.Community Edition
3.0.1
addresses this advisory
Affected CE versions
>= 2.0, < 3.0.1
Enterprise Edition
3.0.1, 2.13.11
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.11 || >= 3.0, < 3.0.1
Upgrade to the addressed version or later to remediate this vulnerability.
Stay up to date with KrakenD releases and important updates