CVE-2026-54247: Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS

July 17, 2026

The Kubernetes admission webhook handler reads the entire request body using io.ReadAll(r.Body) without any size limit. Any client that can reach the webhook port within the cluster can send a multi-GB payload, causing the skipper process to exhaust memory and be OOM-killed. This disrupts all Kubernetes admission control, potentially blocking all pod creation and updates.

References

github.com/advisories/GHSA-cwxq-rc9x-2jvv
github.com/zalando/skipper/releases/tag/v0.26.22
github.com/zalando/skipper/security/advisories/GHSA-cwxq-rc9x-2jvv
nvd.nist.gov/vuln/detail/CVE-2026-54247

Code Behaviors & Features

Detect and mitigate CVE-2026-54247 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →