Go/github.com/zalando/skipper CVE-2026-65838: high 8.2, EPSS 0.46%
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies
Action: Upgrade github.com/zalando/skipper to 0.27.26 or later.
go get github.com/zalando/skipper@v0.27.26Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.27.26 | - |
Fixed versions
| 0.27.26 |
Sources
- osv: GHSA-8qqm-fp2q-v734
- https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734
- https://nvd.nist.gov/vuln/detail/CVE-2026-65838
- https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507
- https://github.com/zalando/skipper
- https://github.com/zalando/skipper/releases/tag/v0.27.26
- https://github.com/zalando/skipper/releases/tag/v0.27.35
CVE-2026-65838 · published · modified · JSON