Oversized Request Authorization Issue in Skipper HTTP Router by Zalando

CVE-2026-86043

What is CVE-2026-86043?

The Skipper HTTP router has an authorization flaw allowing oversized requests to be processed incorrectly. Before version 0.27.37, the opaAuthorizeRequestWithBody filter relied on the Content-Length header for determining body size, which could allow a body-inspecting policy to permit requests with oversized payloads, forwarding them to upstream services. This issue arises from the truncation logic that doesn't properly signal a truncated request, especially under certain HTTP protocols without a Content-Length header. This flaw has been resolved in version 0.27.37.

References