News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-78669 CVE High · CVSS 7.5 Medium Impact

net/http: HTTP/2 CPU Exhaustion via Repeated Initial Window Size Changes

Exploitable under specific conditions

This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

Reachable from clients when KrakenD’s HTTP server speaks HTTP/2, which happens when you enable TLS on the service (HTTP/2 is negotiated through ALPN) or set use_h2c. Reachable from upstream when a malicious or compromised backend negotiates HTTP/2 with KrakenD. Deployments that use HTTP/1.1 on both sides are not exposed.

Component

Go standard library (net/http)

Disclosed

Oct 13, 2026

CVSS Score

7.5

Description

A malicious HTTP/2 peer can open many streams and then send a stream of small SETTINGS frames that keep changing SETTINGS_INITIAL_WINDOW_SIZE. Go processed each change inefficiently across every open stream, so the peer consumes excessive CPU with very little traffic, a denial of service. Both the HTTP/2 server and the HTTP/2 client transport are affected.

Version summary

Community Edition

3.0.1

addresses this advisory

Affected CE versions

>= 2.0, < 3.0.1

Enterprise Edition

3.0.1, 2.13.11

addresses this advisory

Affected EE versions

>= 2.0, < 2.13.11 || >= 3.0, < 3.0.1

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-78669 on Go Issue Tracker View CVE-2026-78669 on Go Vulnerability Database

Stay up to date with KrakenD releases and important updates