CVE-2026-6993

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 0284a5bcf92b5a7ee015300ce3051baf7ae4718d. Applying a patch is advised to resolve this issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-441

Affected software

No affected versions have been published.

Timeline

Published: Apr 25, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-699307.5Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to disclose information over a network.CVE-2026-699317.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker CVE-2026-699347.8Integer overflow or wraparound in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.CVE-2026-699357.0Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-69946.3A weakness has been identified in Envoy up to 1.33.0. Affected is the function params.add of the file source/extensions/filters/http/header_CVE-2026-699406.5Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to disclose information over a network.CVE-2026-699427.8Buffer over-read in Windows Overlay Filter allows an authorized attacker to execute code locally.CVE-2026-699438.8Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker CVE-2026-699458.8Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.CVE-2026-699476.8Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack.CVE-2026-699497.8Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally.CVE-2026-69952.4A security flaw has been discovered in BDCOM P3310D 0.4.2 10.1.0F Build 86345. The impacted element is an unknown function of the file /inde