GHSA-8qqm-fp2q-v734: Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies
(updated )
A wrong policy can be an open door.
You have to check input.attributes.request.http.truncated_body in your policy.
References
- github.com/advisories/GHSA-8qqm-fp2q-v734
- github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507
- github.com/zalando/skipper/releases/tag/v0.27.26
- github.com/zalando/skipper/releases/tag/v0.27.35
- github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734
- nvd.nist.gov/vuln/detail/CVE-2026-65838
Code Behaviors & Features
Detect and mitigate GHSA-8qqm-fp2q-v734 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →