Vulnerability GO-2026-6495
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 hours ago
September 28, 2026 at 04:43 PM UTC
Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper
v0.9.0 - v0.27.36
v0.9.0 - v0.27.36
Summary
Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper
Details
Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
11 days ago
Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)
v0.9.0 - v0.27.36 GHSA-5gpm-rgj3-9q76
v0.9.0 - v0.27.36 GHSA-5gpm-rgj3-9q76
Unknown
2 months ago
Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS in github.com/zalando/skipper
v0.9.0 - v0.26.21 GO-2026-6015
v0.9.0 - v0.26.21 GO-2026-6015
Unknown
2 months ago
Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication in github.com/zalando/skipper
v0.9.0 - v0.27.12 GO-2026-6018
v0.9.0 - v0.27.12 GO-2026-6018
Unknown
2 months ago
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper
v0.9.0 - v0.27.25 GO-2026-6019
v0.9.0 - v0.27.25 GO-2026-6019
High Risk
2 months ago
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies
v0.9.0 - v0.27.25 GHSA-8qqm-fp2q-v734
v0.9.0 - v0.27.25 GHSA-8qqm-fp2q-v734
Impacted packages
Timeline
Published
2 hours ago
September 28, 2026 at 04:43 PM UTC
Last Modified
2 hours ago
September 28, 2026 at 05:00 PM UTC