Description
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kong | Kong Enterprise Gateway | 3.4.0.0 – < 3.4.3.27, 3.10.0.0 – < 3.10.0.12, 3.11.0.0 – < 3.11.0.12, 3.12.0.0 – < 3.12.0.7, 3.13.0.0 – < 3.13.0.5, 3.14.0.0 – < 3.14.0.4 | 3.4.3.27 |
References
- https://support.konghq.com/support/s/article/CVE-2026-6338 vendor-advisory