Medium 5.3Published Apr 25, 2026

CVE-2026-6993go-kratos http.DefaultServeMux Fallback server.go NewServer confused deputy

Updated under an hour ago (Oct 26, 2026, 10:00 PM ET)

Does this affect you?

It affects go-kratos kratos. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for go-kratos kratos

Exploited in the last 30 days

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 0284a5bcf92b5a7ee015300ce3051baf7ae4718d. Applying a patch is advised to resolve this issue.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
Weakness (CWE): CWE-441
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: Apr 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

go-kratos kratos go_kratos:kratos (from the name)	2.9.0; 2.9.1; 2.9.2	CNA record

References

References

https://vuldb.com/vuln/359545	vdb-entry, technical-description
https://vuldb.com/vuln/359545/cti	signature, permissions-required
https://vuldb.com/submit/797099	third-party-advisory
https://github.com/go-kratos/kratos/issues/3810	exploit, issue-tracking
https://github.com/go-kratos/kratos/pull/3814	issue-tracking, patch
https://github.com/Yanhu007/kratos/commit/0284a5bcf92b5a7ee015300ce3051baf7ae4718d	patch
https://github.com/go-kratos/kratos/	product

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.