Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

Skipper may let oversized requests bypass body checks

CVE-2026-65838 · published 1 month ago
Summary

If you use Skipper version earlier than 0.27.35 to inspect request bodies, an attacker can send a request that claims a larger size than it actually contains. The extra data is sent to your backend even though the policy that should reject it sees an empty body, allowing forbidden content through. Upgrade Skipper to version 0.27.35 or later to ensure body size limits are enforced correctly.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
zalando skipper < 0.27.35
Original advisory text
Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-754Improper Check for Unusual or Exceptional Conditions
Timeline
Published14 Sep 2026
Updated4 Nov 2026
First seen14 Sep 2026
Sources
CVE-2026-65838 · NVD
CVE-2026-65838 · MITRE
Track software like this
Free during beta