News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-94439 CVE High · CVSS 7.5 False Positive

net/http: HTTP/1 Server Request Smuggling After 2xx CONNECT Response

This advisory does not affect KrakenD

The flaw requires a handler that accepts CONNECT and answers with a 2xx status. KrakenD endpoints only accept GET, POST, PUT, PATCH and DELETE, so the router never hands a CONNECT request to a handler that could answer it with 2xx.

Addressed through routine dependency maintenance in CE 3.0.1 and EE 3.0.1, 2.13.11.

Component

Go standard library (net/http)

Disclosed

Oct 13, 2026

CVSS Score

7.5

Description

When a Go HTTP/1 handler answered a CONNECT request with a 2xx status and returned without hijacking the connection, the server kept reading and serving HTTP requests on it. An intermediary that treats the connection as an open tunnel after the 2xx while the Go server still treats it as HTTP lets an attacker smuggle requests past the intermediary. The fix always closes the connection after a CONNECT. This does not affect KrakenD.

References

View CVE-2026-94439 on Go Issue Tracker View CVE-2026-94439 on Go Vulnerability Database

Stay up to date with KrakenD releases and important updates