News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-78660 CVE High · CVSS 7.5 Low Impact

net/http: HTTP/2 Transport Accepts Malformed Framing Headers

Limited exploitability

Exploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.

Requires a malicious or compromised backend that KrakenD reaches over HTTP/2, plus a downstream HTTP/1 client or intermediary that parses the forwarded framing headers leniently. Ordinary API clients cannot trigger it, and deployments whose backends use HTTP/1.1 are not exposed.

Component

Go standard library (net/http)

Disclosed

Oct 13, 2026

CVSS Score

7.5

Description

Go’s HTTP/2 client transport accepted response headers that are forbidden in HTTP/2 because they control message framing in HTTP/1, such as Transfer-Encoding. A Go reverse proxy talking HTTP/2 to its backend could forward them to HTTP/1 clients, and a lenient downstream parser could then be tricked into response smuggling. The fix strips those headers in the transport.

Version summary

Community Edition

3.0.1

addresses this advisory

Affected CE versions

>= 2.0, < 3.0.1

Enterprise Edition

3.0.1, 2.13.11

addresses this advisory

Affected EE versions

>= 2.0, < 2.13.11 || >= 3.0, < 3.0.1

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-78660 on Go Issue Tracker View CVE-2026-78660 on Go Vulnerability Database

Stay up to date with KrakenD releases and important updates