News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-94440 CVE High · CVSS 7.5 Medium Impact

mime/multipart: Memory Limit Bypass via Oversized MIME Header Line

Exploitable under specific conditions

This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

KrakenD forwards request bodies to the backends without parsing them, so the vulnerable parser only runs when a component reads the request as a multipart form. The max_multipart_memory router option sets the memory limit that this bug bypasses. Endpoints that never parse multipart bodies are not exposed.

Component

Go standard library (mime/multipart, net/textproto)

Disclosed

Oct 13, 2026

CVSS Score

7.5

Description

When fewer than 400 bytes of the memory limit remained at the start of a multipart part, Go’s mime/multipart reader, through net/textproto, could read an arbitrarily long header line into memory without enforcing the limit. A client sending a crafted multipart/form-data body to a server that parses it with ParseMultipartForm, FormFile or ReadForm makes the server allocate far more than the configured maximum, a memory exhaustion denial of service.

Version summary

Community Edition

3.0.1

addresses this advisory

Affected CE versions

>= 2.0, < 3.0.1

Enterprise Edition

3.0.1, 2.13.11

addresses this advisory

Affected EE versions

>= 2.0, < 2.13.11 || >= 3.0, < 3.0.1

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-94440 on Go Issue Tracker View CVE-2026-94440 on Go Vulnerability Database

Stay up to date with KrakenD releases and important updates