Skip to content
CVE PROGRAM SOURCE RECORD4.9 Medium

CVE-2026-6338

HTTP request smuggling in Kong Enteprise Gateway

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Kong

Description

A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kong Kong Enterprise Gateway

Default version status: unaffected

  • 3.4.0.0 to < 3.4.3.27affected
  • 3.10.0.0 to < 3.10.0.12affected
  • 3.11.0.0 to < 3.11.0.12affected
  • 3.12.0.0 to < 3.12.0.7affected
  • 3.13.0.0 to < 3.13.0.5affected
  • 3.14.0.0 to < 3.14.0.4affected

References