CVE-2026-6993

Name of the Vulnerable Software and Affected Versions go-kratos kratos versions prior to 2.9.3

Description A security flaw in the http.DefaultServeMux Fallback Handler allows a remote attacker to cause an unintended intermediary. This issue occurs within the NewServer() function located in the transport/http/server.go file.

Recommendations Apply patch 0284a5bcf92b5a7ee015300ce3051baf7ae4718d to resolve the issue. As a temporary workaround, restrict access to the NewServer() function in the transport/http/server.go file to minimize the risk of exploitation.