GoPackage

github.com/zalando/skipper

9 known vulnerabilities (1 critical, 5 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: v0.28.71 (Nov 6, 2026): no advisory affects it
Newest unaffected release: v0.28.71 (Nov 6, 2026), the latest release
Advisories: 9 · 1 critical, 5 high, 2 medium

Releases: 500+ since v0.22.29 (May 9, 2025)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-86043
Affects v0.22.29 to v0.27.36 (v0.27.37 is outside it)
CVE-2026-54247
Affects v0.22.29 to v0.26.21 (v0.26.22 is outside it)
CVE-2026-54246
Affects v0.22.29 to v0.27.12 (v0.27.13 is outside it)
CVE-2026-65838
Affects v0.22.29 to v0.27.25 (v0.27.26 is outside it)
CVE-2026-50197
Affects v0.22.29 to v0.26.9 (v0.26.10 is outside it)
CVE-2026-24470
Affects v0.22.29 to v0.23.1 (v0.24.0 is outside it)
CVE-2026-23742
Affects v0.22.29 to v0.22.223 (v0.23.0 is outside it)
CVE-2022-38580
No published release is affected
No published release is affected
CVE-2022-34296
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 9

CVE-2026-86043High 7.5
Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)
Affected: fixed in 0.27.37.
Fixed in v0.27.37 (released Jul 21, 2026, 57 days before disclosure).
The latest release, v0.28.71, is not affected.
CVE-2026-54247Medium 4.3
Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS
Affected: fixed in 0.26.22.
Fixed in v0.26.22 (released Jun 5, 2026, 101 days before disclosure).
The latest release, v0.28.71, is not affected.
CVE-2026-54246Medium 5.7
Skipper routesrv-no-auth: All routesrv API Endpoints Lack Authentication
Affected: fixed in 0.27.13.
Fixed in v0.27.13 (released Jun 23, 2026, 83 days before disclosure).
The latest release, v0.28.71, is not affected.
CVE-2026-65838High 8.2
Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN…
Affected: fixed in 0.27.26.
Fixed in v0.27.26 (released Jul 9, 2026, 67 days before disclosure).
The latest release, v0.28.71, is not affected.
CVE-2026-50197High 7.8
Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests
Affected: fixed in 0.26.10.
Fixed in v0.26.10 (released Jun 1, 2026, 46 days before disclosure).
The latest release, v0.28.71, is not affected.
CVE-2026-24470High 8.1
Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName
Affected: fixed in 0.24.0.
Fixed in v0.24.0 (released Jan 26, 2026, the day of disclosure).
The latest release, v0.28.71, is not affected.
CVE-2026-23742High 8.8
Skipper arbitrary code execution through lua filters
Affected: fixed in 0.23.0.
Fixed in v0.23.0 (released Jan 16, 2026, the day of disclosure).
The latest release, v0.28.71, is not affected.
CVE-2022-38580Critical 9.8
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
Affected: fixed in 0.13.237.
Fixed in 0.13.237.
The latest release, v0.28.71, is not affected.
CVE-2022-34296Unrated
In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.
Affected: fixed in 0.13.218.
Fixed in 0.13.218.
The latest release, v0.28.71, is not affected.