{"action":"Upgrade github.com/zalando/skipper to 0.27.37 or later.","affected":[{"fixed":"0.27.37","introduced":"0"}],"component":"github.com/zalando/skipper","cve_ids":["CVE-2026-86043"],"ecosystem":"Go","epss":0.00451,"exploited":false,"fixed_versions":["0.27.37"],"ghsa_id":"GHSA-5gpm-rgj3-9q76","id":"tcs_01M5KEYB3NGB15102991B2NA9X","modified_at":"2026-09-28T17:11:13.345846346Z","published_at":"2026-09-17T17:05:57Z","references":["https://osv.dev/vulnerability/GHSA-5gpm-rgj3-9q76","https://github.com/zalando/skipper/security/advisories/GHSA-5gpm-rgj3-9q76","https://nvd.nist.gov/vuln/detail/CVE-2026-86043","https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507","https://github.com/zalando/skipper","https://github.com/zalando/skipper/releases/tag/v0.27.35","https://github.com/zalando/skipper/releases/tag/v0.27.37","https://github.com/zalando/skipper/tree/v0.27.35"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-5gpm-rgj3-9q76","url":"https://osv.dev/vulnerability/GHSA-5gpm-rgj3-9q76"}],"summary":"Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)"}