Security
فارسی
All products

github.com/zalando/skipper

Go · Package
9 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)CVE-2026-86043 · GHSA-5GPM-RGJ3-9Q76Version ranges need review. github.com/zalando/skipper Go High Fix reported
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policiesCVE-2026-65838 · GHSA-8QQM-FP2Q-V734Version ranges need review. github.com/zalando/skipper Go High Fix reported
Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoSCVE-2026-54247 · GHSA-CWXQ-RC9X-2JVVVersion ranges need review. github.com/zalando/skipper Go Medium Fix reported
Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack AuthenticationCVE-2026-54246 · GHSA-5587-2X54-JJ6HVersion ranges need review. github.com/zalando/skipper Go Medium Fix reported
Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requestsCVE-2026-50197 · GHSA-659F-RGP5-W4WFVersion ranges need review. github.com/zalando/skipper Go High Fix reported
Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalNameCVE-2026-24470 · GHSA-MXXC-P822-2HX9Version ranges need review. github.com/zalando/skipper Go High Fix reported
Skipper is vulnerable to arbitrary code execution through lua filtersCVE-2026-23742 · GHSA-CC8M-98FM-RC9GVersion ranges need review. github.com/zalando/skipper Go High Fix reported
Query predicate bypass in Zalando SkipperCVE-2022-34296 · GHSA-QX2J-85Q5-FFP8Version ranges need review. github.com/zalando/skipper Go High Fix reported
Skipper vulnerable to SSRF via X-Skipper-ProxyCVE-2022-38580 · GHSA-F2RJ-M42R-6JM2Version ranges need review. github.com/zalando/skipper Go Critical Fix reported