This vulnerability (CVE-2026-6338) affects multiple specific versions of Kong Enterprise Gateway. It is caused by a flaw in how Kong parses HTTP/1.1 requests, resulting in HTTP request smuggling and desynchronization issues. The inconsistency in request interpretation can potentially be exploited to bypass security controls or interfere with normal request handling. The CVSS 4.9 score reflects a medium severity with network attack vector, low attack complexity, and partial remediation impact. No official patch or remediation guidance has been published by the vendor as of the data provided.

The vulnerability allows an attacker to perform HTTP request smuggling, which can lead to desynchronization between front-end and back-end servers. This may enable bypassing security controls, request/response manipulation, or other unintended behaviors in the affected Kong Gateway versions. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor vendor communications for updates. Until a patch is available, cautious handling of untrusted HTTP/1.1 traffic and additional inspection at network boundaries may help reduce risk.