News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-78659 CVE High · CVSS 7.5 Medium Impact

net/http: HTTP/2 Server Memory Exhaustion via Declared Trailer Headers

Exploitable under specific conditions

This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

Reachable only when KrakenD’s HTTP server speaks HTTP/2, which happens when you enable TLS on the service (HTTP/2 is negotiated through ALPN) or set use_h2c to accept unencrypted HTTP/2. Deployments that serve plain HTTP/1.1, for instance behind a load balancer that terminates TLS, are not exposed.

Component

Go standard library (net/http)

Disclosed

Oct 13, 2026

CVSS Score

7.5

Description

Go’s HTTP/2 server pre-populates Request.Trailer from the names a client declares in the Trailer request header. Those declarations were not counted against Server.MaxHeaderBytes or the header value count limit, so a client declaring a huge number of trailer fields forced the server into a disproportionate allocation. Many such requests exhaust server memory, a remote denial of service. HTTP/1 servers are not affected. The fix applies the header limits to declared trailers.

Version summary

Community Edition

3.0.1

addresses this advisory

Affected CE versions

>= 2.0, < 3.0.1

Enterprise Edition

3.0.1, 2.13.11

addresses this advisory

Affected EE versions

>= 2.0, < 2.13.11 || >= 3.0, < 3.0.1

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-78659 on Go Issue Tracker View CVE-2026-78659 on Go Vulnerability Database

Stay up to date with KrakenD releases and important updates