News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.1, EE 3.0.1 and EE 2.13.11 Update Released News KrakenD Partners with CGK Solutions to Secure API Integration in Italy Case Study Every Change Reviewed, Every Peak Absorbed: Paribu's API Gateway

CVE-2026-97031 CVE High · CVSS 7.5 False Positive

crypto/tls: Memory Exhaustion via Repeated ECH Outer Extension References

This advisory does not affect KrakenD

The vulnerable code only runs on a TLS server that decrypts Encrypted Client Hello, which requires ECH keys in its TLS configuration. KrakenD’s TLS settings do not configure ECH keys, so its server never processes ECH outer extensions.

Addressed through routine dependency maintenance in CE 3.0.1 and EE 3.0.1, 2.13.11.

Component

Go standard library (crypto/tls)

Disclosed

Oct 13, 2026

CVSS Score

7.5

Description

RFC 9849 forbids a ClientHello from referencing the same Encrypted Client Hello (ECH) outer extension more than once, but Go’s crypto/tls accepted repeated references. A client sending a crafted ClientHello with many of them to a server that has ECH enabled amplifies the memory the server allocates during the handshake, a denial of service. The fix rejects those ClientHellos as malformed. This does not affect KrakenD.

References

View CVE-2026-97031 on Go Issue Tracker View CVE-2026-97031 on Go Vulnerability Database

Stay up to date with KrakenD releases and important updates