Kong

6 CVEs across 6 Kong products. Browse Kong vulnerabilities, severities, and proof-of-concept exploits.

Kong products with known CVEs

ProductCVEs
Inf081
Insomnia1
Kong Alpine Docker Image1
Kong Enterprise Gateway1
Kong Event Gateway1
Lua-Multipart1
Kong CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-175782026-08-05Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encry…
CVE-2026-63382026-06-11A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is…
CVE-2025-1353High7.02025-02-16A vulnerability was found in Kong Insomnia up to 10.3.0 and classified as critical. This issue affects some unknown processing in the library profapi.dll. The…
CVE-2020-36661Low3.52023-02-12A vulnerability was found in Kong lua-multipart 0.5.8-1. It has been declared as problematic. This vulnerability affects the function is_header of the file src…
CVE-2020-35189Critical9.82020-12-17The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. System using the kong docker container deployed…
CVE-2012-65722013-06-21Cross-site scripting (XSS) vulnerability in the phptemplate_preprocess_node function in template.php in the Inf08 theme 6.x-1.x before 6.x-1.10 for Drupal allo…