KrakenD CE 3.0.4, EE 3.0.4 and EE 2.13.14 Update Released | KrakenD API Gateway

News KrakenD 3.0 Is Here: AI Router, Semantic Cache, and On-the-Fly Stream Manipulation News KrakenD CE 3.0.4, EE 3.0.4 and EE 2.13.14 Update Released News What Is an AI Gateway? Architecture, Controls and Use Cases News KrakenD CE 3.0.3, EE 3.0.3 and EE 2.13.13 Update Released
Open Source API Gateway Free to use The high-performance open source API gateway, free to use and trusted by thousands of teams.
API Gateway Enterprise-Grade with SLAs Production-grade gateway with security, governance, and 24/7 support backed by SLAs.
AI Gateway Same Gateway, Now for AI LLM routing, prompt guardrails, token budgets, and a built-in MCP server, all from one gateway.
Software Architect, Single.Earth
Software Architect, Single.Earth
Enterprise Architecture, lastminute.com
This patch release of KrakenD Community Edition and Enterprise Edition upgrades Go to 1.27.4 to address several disclosed CVEs, upgrades the CEL library, and brings a round of quota, AI Gateway and plugin fixes to the Enterprise Edition. We recommend upgrading, especially if you use monthly quotas in Enterprise. For 2.x users, Enterprise 2.13.14 backports the same security and CEL upgrades.
All three releases move to Go 1.27.4, which fixes twelve CVEs. One of them lives in the HTTP server: CVE-2026-97054 can crash an HTTP/1 server that limits the request body with MaxBytesReader when a handler reads the body while it writes the response headers. KrakenD EE is exposed when you set the maximum request size (max_payload) at the service level: a client sending a body over the limit can crash the gateway. The endpoint-level max_payload and the Community Edition are not affected.
The other eleven CVEs live in the Go toolchain and abuse cgo flags and directives to run code or inject linker options while compiling. They do not affect the KrakenD binary. If you compile Enterprise plugins, use the krakend/builder-ee image of the new version, which ships the fixed toolchain.
The Enterprise releases upgrade the compress dependency to fix CVE-2026-116591. A crafted zstd message can crash the decoder, and KrakenD decodes zstd when it consumes messages from Kafka, through the Kafka subscriber and the Kafka async agent. An attacker needs write access to a topic KrakenD consumes, or a position to tamper with the broker traffic, and the result is a crash of the gateway. Until you upgrade, restrict write access on the consumed topics to trusted producers and use TLS for broker connections.
Check our security advisories page for more details on how each CVE affects KrakenD.
KrakenD EE 3.0.4 fixes three issues in quotas:
The AI Router no longer treats successful Amazon Bedrock responses as failures, which triggered the failover provider on every call. The regular expressions of the Prompt Guard now check every string of a JSON body, including those nested in objects or arrays such as chat messages, instead of only the top-level values.
The krakend ai download-model command accepts a --cache-dir option to set the download cache directory, which defaults to a temporary directory, and a --timeout option that defaults to 1m.
KrakenD EE 3.0.4 also fixes a breaking change introduced in 3.0.0 in the interfaces of the request and response modifier plugins, so existing modifier plugins work again.
All three releases upgrade the library behind Common Expression Language (CEL) expressions, which in Enterprise also powers Security Policies. The new version limits how deep and how large an expression can be, and the timestamp() function rejects strings that are not in RFC 3339 format. If any of your expressions or policies convert dates in other formats with timestamp(), review them before upgrading.
The full list of changes for each version follows.
Recommended security upgrade addressing several vulnerabilities and feature fixes
Upgrading to the latest version is always advised.
Recommended security upgrade addressing several vulnerabilities
Upgrading to the latest version is always advised.
Recommended security backport upgrade addressing several vulnerabilities
Upgrading to the latest version is always advised.
Stay up to date with KrakenD releases and important updates
Made with in Barcelona
SOC 2 Type II Certification
Copyright © KRAKEND S.L.U.
Terms & Conditions - Cookies Policy - Privacy Policy - Security Policy - Trust Center