← CVE Intelligence

CVE-2026-6338

HTTP request smuggling in Kong Enteprise Gateway PUBLISHED

Description (CNA)

A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic.

Affected (CNA)

Vendor / productVersions
Kong / Kong Enterprise Gatewayaffected 3.4.0.0 before 3.4.3.27; affected 3.10.0.0 before 3.10.0.12; affected 3.11.0.0 before 3.11.0.12; affected 3.12.0.0 before 3.12.0.7; affected 3.13.0.0 before 3.13.0.5; affected 3.14.0.0 before 3.14.0.4

CWE

CWE-444

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.