CVE-2026-6993 Details

A vulnerability exists in go-kratos kratos versions through 2.9.2, where the HTTP server's fallback handler for unmatched routes and disallowed methods can unintentionally expose debug profiling endpoints. This occurs because the server uses http.DefaultServeMux, a global shared instance that may contain handlers registered by other packages, such as net/http/pprof', which adds unprotected debug routes. As a result, an unauthenticated remote attacker could access sensitive profiling data or disrupt service by exploiting the exposed endpoints.

Users can manually override the default NotFoundHandler and MethodNotAllowedHandler to return proper HTTP error responses. Instructions for applying this workaround can be found in the Kratos documentation.