News KrakenD CE 2.13.11 and EE 2.13.9 update released

CVE-2026-84304 CVE High · CVSS 7.5 Medium Impact

grpc: Heap Memory Exhaustion via Fragmented HTTP/2 DATA Frames

Exploitable under specific conditions

This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

Reachable when a deployment terminates or originates gRPC traffic. The Enterprise grpc server exposes gRPC methods to external clients, which lets an unauthenticated caller reach the vulnerable transport directly. The backend/grpc client and the OTLP/gRPC exporter of telemetry/opentelemetry reach the same receive path from a malicious or compromised upstream or collector. Deployments that expose no gRPC server and use no gRPC backend or OTLP/gRPC exporter are not exposed.

Component

gRPC for Go (grpc-go)

Disclosed

Sep 7, 2026

CVSS Score

7.5

Description

A remote peer can open a gRPC stream and split its payload across millions of tiny HTTP/2 DATA frames. Every fragment carries its own tracking structures and queue allocation, so the heap a stream consumes grows far beyond the negotiated connection and stream flow-control windows. Multiplexing several such streams exhausts the Go runtime’s memory and forces an out-of-memory condition, a remote denial of service. The fix compacts the receive buffer by coalescing consecutive small buffers from a shared pool, and is enabled by default in grpc-go 1.83.1.

Version summary

Community Edition

2.13.11

addresses this advisory

Affected CE versions

>= 2.0, < 2.13.11

Enterprise Edition

2.13.9

addresses this advisory

Affected EE versions

>= 2.0, < 2.13.9

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-84304 on NVD

Stay up to date with KrakenD releases and important updates