CVE-2026-3206

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3206", "assignerOrgId": "e5bd9809-e237-4575-952b-81f8a96826ee", "state": "PUBLISHED", "assignerShortName": "KrakenD", "dateReserved": "2026-02-25T15:11:30.701Z", "datePublished": "2026-02-25T15:12:23.336Z", "dateUpdated": "2026-02-25T20:21:08.239Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["CircuitBreaker"], "product": "KrakenD-CE", "vendor": "KrakenD", "versions": [{"lessThan": "2.13.1", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "modules": ["CircuitBreaker"], "product": "KrakenD-EE", "vendor": "KrakenD", "versions": [{"lessThan": "2.12.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:krakend:krakend-ce:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.13.1", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:krakend:krakend-ee:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.12.5", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Resource Shutdown or Release vulnerability in KrakenD, SLU KrakenD-CE (CircuitBreaker modules), KrakenD, SLU KrakenD-EE (CircuitBreaker modules). This issue affects KrakenD-CE: before 2.13.1; KrakenD-EE: before 2.12.5."}], "value": "Improper Resource Shutdown or Release vulnerability in KrakenD, SLU KrakenD-CE (CircuitBreaker modules), KrakenD, SLU KrakenD-EE (CircuitBreaker modules).\u00a0This issue affects KrakenD-CE: before 2.13.1; KrakenD-EE: before 2.12.5."}], "metrics": [{"cvssV4_0": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 1.3, "baseSeverity": "LOW", "exploitMaturity": "UNREPORTED", "privilegesRequired": "LOW", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:A/V:D/RE:L/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-404", "description": "CWE-404 Improper Resource Shutdown or Release", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e5bd9809-e237-4575-952b-81f8a96826ee", "shortName": "KrakenD", "dateUpdated": "2026-02-25T16:07:35.643Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.krakend.io/blog/krakend-ee-2.12.5-release-notes/"}, {"tags": ["patch", "vendor-advisory"], "url": "https://www.krakend.io/blog/krakend-2.13.1-release-notes/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Vulnerability has been fixed. Patched versions are available."}], "value": "Vulnerability has been fixed. Patched versions are available."}], "source": {"discovery": "INTERNAL"}, "title": "Improper management of context cancelations", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T20:20:56.492184Z", "id": "CVE-2026-3206", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:21:08.239Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3206", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T20:20:56.492184Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:21:03.676Z"}}], "cna": {"title": "Improper management of context cancelations", "source": {"discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "AUTOMATIC", "baseScore": 1.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:A/V:D/RE:L/U:Clear", "exploitMaturity": "UNREPORTED", "providerUrgency": "CLEAR", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "KrakenD", "modules": ["CircuitBreaker"], "product": "KrakenD-CE", "versions": [{"status": "affected", "version": "0", "lessThan": "2.13.1", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "KrakenD", "modules": ["CircuitBreaker"], "product": "KrakenD-EE", "versions": [{"status": "affected", "version": "0", "lessThan": "2.12.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Vulnerability has been fixed. Patched versions are available.", "supportingMedia": [{"type": "text/html", "value": "Vulnerability has been fixed. Patched versions are available.", "base64": false}]}], "references": [{"url": "https://www.krakend.io/blog/krakend-ee-2.12.5-release-notes/", "tags": ["vendor-advisory", "patch"]}, {"url": "https://www.krakend.io/blog/krakend-2.13.1-release-notes/", "tags": ["patch", "vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Resource Shutdown or Release vulnerability in KrakenD, SLU KrakenD-CE (CircuitBreaker modules), KrakenD, SLU KrakenD-EE (CircuitBreaker modules).\u00a0This issue affects KrakenD-CE: before 2.13.1; KrakenD-EE: before 2.12.5.", "supportingMedia": [{"type": "text/html", "value": "Improper Resource Shutdown or Release vulnerability in KrakenD, SLU KrakenD-CE (CircuitBreaker modules), KrakenD, SLU KrakenD-EE (CircuitBreaker modules). This issue affects KrakenD-CE: before 2.13.1; KrakenD-EE: before 2.12.5.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "CWE-404 Improper Resource Shutdown or Release"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:krakend:krakend-ce:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.13.1", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:krakend:krakend-ee:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.12.5", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "e5bd9809-e237-4575-952b-81f8a96826ee", "shortName": "KrakenD", "dateUpdated": "2026-02-25T16:07:35.643Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3206", "state": "PUBLISHED", "dateUpdated": "2026-02-25T20:21:08.239Z", "dateReserved": "2026-02-25T15:11:30.701Z", "assignerOrgId": "e5bd9809-e237-4575-952b-81f8a96826ee", "datePublished": "2026-02-25T15:12:23.336Z", "assignerShortName": "KrakenD"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["CircuitBreaker"], "product": "KrakenD-CE", "vendor": "KrakenD", "versions": [{"lessThan": "2.13.1", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "modules": ["CircuitBreaker"], "product": "KrakenD-EE", "vendor": "KrakenD", "versions": [{"lessThan": "2.12.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "e5bd9809-e237-4575-952b-81f8a96826ee"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Resource Shutdown or Release vulnerability in KrakenD, SLU KrakenD-CE (CircuitBreaker modules), KrakenD, SLU KrakenD-EE (CircuitBreaker modules).\u00a0This issue affects KrakenD-CE: before 2.13.1; KrakenD-EE: before 2.12.5."}, {"lang": "es", "value": "Vulnerabilidad de cierre o liberaci\u00f3n inadecuada de recursos en KrakenD, SLU KrakenD-CE (m\u00f3dulos CircuitBreaker), KrakenD, SLU KrakenD-EE (m\u00f3dulos CircuitBreaker). Este problema afecta a KrakenD-CE: versiones anteriores a 2.13.1; KrakenD-EE: versiones anteriores a 2.12.5."}], "id": "CVE-2026-3206", "lastModified": "2026-06-17T10:43:12.517", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "AUTOMATIC", "Safety": "NEGLIGIBLE", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "CLEAR", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:L/U:Clear", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "LOW"}, "source": "e5bd9809-e237-4575-952b-81f8a96826ee", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3206", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T20:20:56.492184Z", "version": "2.0.3"}}]}, "published": "2026-02-25T16:23:30.423", "references": [{"source": "e5bd9809-e237-4575-952b-81f8a96826ee", "url": "https://www.krakend.io/blog/krakend-2.13.1-release-notes/"}, {"source": "e5bd9809-e237-4575-952b-81f8a96826ee", "url": "https://www.krakend.io/blog/krakend-ee-2.12.5-release-notes/"}], "sourceIdentifier": "e5bd9809-e237-4575-952b-81f8a96826ee", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}], "source": "e5bd9809-e237-4575-952b-81f8a96826ee", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.13.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "KrakenD-CE", "source": "cna", "vendor": "KrakenD"}, "product": "krakend-ce", "vendor": "krakend"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.12.5)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "KrakenD-EE", "source": "cna", "vendor": "KrakenD"}, "product": "krakend-ee", "vendor": "krakend"}], "analysis": {"en": {"generated_at": "2026-04-18T10:43:27.294043+00:00", "value": {"mitigation_remediation": ["Upgrade KrakenD-CE to version 2.13.1 or later", "Upgrade KrakenD-EE to version 2.12.5 or later", "Limit concurrent requests or enable rate limiting to mitigate the risk of resource exhaustion until the patch is applied"], "summary": {"action": "Patch", "impact": "Denial of Service through uncontrolled resource leakage"}, "threat_synthesis": {"affected_systems": "KrakenD Community Edition before version 2.13.1 and KrakenD Enterprise Edition before version 2.12.5 are susceptible. These versions employ the CircuitBreaker modules where the context cancelation logic is flawed. Any deployment of these editions that still uses the legacy CircuitBreaker code is at risk.", "description_and_impact": "This vulnerability arises from improper handling of context cancellations in the CircuitBreaker modules of KrakenD. When a context is cancelled, the program does not adequately close or release related resources, creating a leak that can exhaust system resources over time. The weakness is classified as CWE-404, an improper resource shutdown or release flaw, indicating that the application may fail to shut down resources correctly when required. The net consequence is a gradual degradation of the service, potentially leading to service interruption if the leaked resources accumulate.", "risk_and_exploitability": "The CVSS base score is 1.3, signifying a low severity. The EPSS score is reported as < 1\u202f%, indicating a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local or remote through API calls that exercise the CircuitBreaker; an attacker would need to trigger context cancellations repeatedly to exhaust resources. Because the flaw requires repeated activity and is not easily exploitable, immediate damage is limited, but unattended use can still lead to service degradation over time."}}}}, "created": "2026-02-26T13:15:55.208126+00:00", "updated": "2026-04-18T10:45:43.670239+00:00", "vendors": ["krakend", "krakend$PRODUCT$krakend-ce", "krakend$PRODUCT$krakend-ee"]}