Read the docs
TI-2026-39149 Aliases CVE-2026-54247GHSA-cwxq-rc9x-2jvv

Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

Priority LOW 20CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a very large body that causes unbounded memory allocation and an out-of-memory termination of the Skipper process. The disruption is limited to Ingress and RouteGroup admission rather than pod creation or unrelated admission controllers, and Kubernetes normally restarts the process. This issue is fixed in version 0.26.22.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00298 22nd percentileScored 2026-11-07
Fix Fixed skipper (zalando): 0.26.22github.com/zalando/skipper (Go): 0.26.22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zalandoskipperbefore 0.26.220.26.22Patch availableCNA
—github.com/zalando/skipper (Go)before 0.26.220.26.22Patch availableGHSA-cwxq-rc9x-2jvv
  • skipper Vendorzalando Affected before 0.26.22 Fixed in 0.26.22 Patch available CNA
  • github.com/zalando/skipper (Go) Vendor— Affected before 0.26.22 Fixed in 0.26.22 Patch available GHSA-cwxq-rc9x-2jvv

Remediation

  • Fix · CNA skipper (zalando) Fixed in 0.26.22
  • Fix · GHSA-cwxq-rc9x-2jvv github.com/zalando/skipper (Go) Fixed in 0.26.22 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54247
  2. 2026-10-03 Alias added: GHSA-cwxq-rc9x-2jvv

References

Other 5

  • TI-2026-46767 Skipper Incomplete Fix for CVE-2026-50197 Policy Bypass CVSS 4.0HIGH 8.8
  • TI-2026-36956 Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests CVSS 4.0HIGH 7.8
  • TI-2026-58867 Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197) CVSS 3.1HIGH 7.5
  • TI-2022-18154 Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). CVSS 3.1CRITICAL 9.8
  • TI-2026-46913 Improper check for unusual conditions in zalando skipper CVSS 3.1HIGH 8.2
  • TI-2026-19115 Skipper arbitrary code execution through lua filters CVSS 3.1HIGH 8.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences