Kong Gateway Enterprise EUVD-2026-36246

Exploitation requires Kong Gateway Enterprise in the 3.4, 3.10, 3.11, 3.12, 3.13, or 3.14 series to be actively processing untrusted HTTP/1.1 client traffic - this is the explicit precondition stated in the CVE description and reflected in the CVSS 4.0 AT:P metric. The gateway must be deployed in a reverse-proxy configuration where it forwards requests to at least one backend service, since the desynchronization impact (SC:H/SI:H) is realized at the backend layer. Deployments that exclusively terminate HTTP/2 or gRPC from external clients, or that enforce strict header normalization upstream of Kong, would not be exposed to this attack vector. The CVSS 4.0 PR:N and UI:N confirm that no authentication and no victim interaction are required once the HTTP/1.1 path is reachable; exploitation is limited only by network access to the Kong listener and the AT:P condition of HTTP/1.1 traffic being in scope.

The CVSS 4.0 base score of 4.9 (Medium) initially appears to understate risk, but the AT:P (Attack Requirements: Present) metric is the key moderating factor - exploitation requires the specific condition of untrusted HTTP/1.1 traffic flowing through Kong. For internet-facing API gateways, this condition is effectively always satisfied in default deployments, meaning the practical attack surface is broad. The SC:H/SI:H downstream impact signals are severe: successful exploitation yields high confidentiality and integrity compromise against backend services and other users' sessions. The E:P (Exploit Public) threat metric confirms proof-of-concept code exists, meaningfully elevating practical risk beyond the base score alone. No EPSS data was provided; no CISA KEV listing means active widespread exploitation is not confirmed, but the public PoC demands prioritized patching for internet-facing deployments. SSVC inference: exploitation effort is low given public PoC, the attack is automatable (AV:N/AC:L/PR:N/UI:N), and technical impact on backend systems is high - this warrants urgent action for affected organizations. No CVSS 3.1 vector was provided in the input; the score and vector assessed independently are provided in the assessed fields below.

An attacker with HTTP access to a Kong Gateway Enterprise instance sends a crafted HTTP/1.1 request with conflicting Content-Length and Transfer-Encoding headers designed to cause Kong and the backend server to disagree on where the request body ends. Kong forwards what it considers a complete request, but the backend's parser treats the smuggled suffix as the beginning of the next incoming request - potentially a legitimate user's request - allowing the attacker to prepend malicious content to it or read the backend's response to that user. With public proof-of-concept code available, an attacker needs only HTTP connectivity to the gateway to attempt exploitation.