github.com/zalando/skipper vulnerabilities (Go)
9 vulnerabilities.
-
github.com/zalando/skipperGo Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197) 7.5 High -
github.com/zalando/skipperGo Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream 8.2 High -
github.com/zalando/skipperGo Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication 5.7 Medium -
github.com/zalando/skipperGo Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS 4.3 Medium -
github.com/zalando/skipperGo Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests 7.8 High -
github.com/zalando/skipperGo Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName 8.1 High -
github.com/zalando/skipperGo Skipper arbitrary code execution through lua filters 8.8 High -
github.com/zalando/skipperGo Skipper vulnerable to SSRF via X-Skipper-Proxy 9.8 Critical -
github.com/zalando/skipperGo Query predicate bypass in Zalando Skipper 7.5 High