News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-78667 CVE High · CVSS 7.5 Medium Impact

net/http: CPU Exhaustion via Unbounded Range Header Parsing

Exploitable under specific conditions

This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

Reachable only through the Enterprise static content features, server/static-filesystem and backend/static-filesystem, which serve files with the affected functions. Deployments that do not serve static content are not exposed. The Community Edition has no static file server.

Component

Go standard library (net/http)

Disclosed

Oct 13, 2026

CVSS Score

7.5

Description

Go’s ServeContent, ServeFile, ServeFileFS and FileServer parsed every range in a request’s Range header without any limit. A client sending a header with a very large number of small ranges forces the server to spend excessive CPU on each request, a denial of service. The fix ignores Range headers with more than 200 ranges, a limit configurable through the new httpservecontentmaxranges GODEBUG setting.

Version summary

Community Edition

Not affected

Enterprise Edition

3.0.1, 2.13.11

addresses this advisory

Affected EE versions

>= 2.0, < 2.13.11 || >= 3.0, < 3.0.1

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-78667 on Go Issue Tracker View CVE-2026-78667 on Go Vulnerability Database

Stay up to date with KrakenD releases and important updates