PT-2026-35166 · Kratos · Kratos

Yu_Bao · Published 2026-04-25 · Updated 2026-04-25 · CVE-2026-6993

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions go-kratos kratos versions prior to 2.9.3

Description A security flaw in the http.DefaultServeMux Fallback Handler allows a remote attacker to cause an unintended intermediary. This issue occurs within the NewServer() function located in the transport/http/server.go file.

Recommendations Apply patch 0284a5bcf92b5a7ee015300ce3051baf7ae4718d to resolve the issue. As a temporary workaround, restrict access to the NewServer() function in the transport/http/server.go file to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-441

Related Identifiers

CVE-2026-6993

GHSA-JJ45-XVQ5-RHH9

Affected Products

Kratos

References · 10

• 🔥 https://github.com/go-kratos/kratos/issues/3810 · Exploit
• https://github.com/go-kratos/kratos/pull/3814 · Patch
• https://github.com/Yanhu007/kratos/commit/0284a5bcf92b5a7ee015300ce3051baf7ae4718d · Patch
• https://osv.dev/vulnerability/GHSA-jj45-xvq5-rhh9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6993 · Security Note
• https://github.com/go-kratos/kratos · Note
• https://vuldb.com/vuln/359545/cti · Note
• https://vuldb.com/submit/797099 · Note
• https://twitter.com/CVEnew/status/2048168331539353610 · Twitter Post
• https://vuldb.com/vuln/359545 · Note