What’s Vulnerable › Vulnerabilities
CVE-2026-6338: HTTP request smuggling in Kong Enteprise Gateway
- Severity: medium (CVSS 4.9 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-11 · updated 2026-10-26
- Weakness: CWE-444
Description
A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic.
Affected products
- Kong Enterprise Gateway: from 3.4.0.0 before 3.4.3.27; from 3.10.0.0 before 3.10.0.12; from 3.11.0.0 before 3.11.0.12; from 3.12.0.0 before 3.12.0.7; from 3.13.0.0 before 3.13.0.5; from 3.14.0.0 before 3.14.0.4 — fixed in 3.10.0.12, 3.11.0.12, 3.12.0.7, 3.13.0.5, 3.14.0.4, 3.4.3.27
How to fix
Upgrade to a fixed version: Kong Enterprise Gateway 3.10.0.12, 3.11.0.12, 3.12.0.7, 3.13.0.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-6338 or the next vulnerability affects your stack