Unbounded Memory Allocation Vulnerability in Skipper by Zalando

CVE-2026-54247

What is CVE-2026-54247?

Skipper, an HTTP router and reverse proxy developed by Zalando, has a vulnerability that affects its handling of request bodies to Kubernetes admission endpoints before version 0.26.22. The issue arises due to insufficient size limitation on the request body handled by the Handler component in the admission process, specifically at the endpoint :9443/admission. This allows attackers with network access and valid client certificates to send excessively large request bodies, leading to unbounded memory allocation. Consequently, this can cause the Skipper process to terminate due to out-of-memory errors. While the issue is primarily confined to Ingress and RouteGroup admissions and does not affect unrelated admission controllers, the disruption it causes can lead to service unavailability until Kubernetes restarts the Skipper process. The vulnerability has been addressed in the fixed release version 0.26.22.

References