https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 10:05:59 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-65838 <p>Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.</p> <p>Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length request to bypass a deny-on-presence Rego policy because ExtractHttpBodyOptionally leaves OPA with an empty parsed_body while forwarding the complete request body upstream. This incomplete remediation of CVE-2026-50197 affects deployments that authorize request-body content and exceed -open-policy-agent-max-request-body-size, which defaults to 1 MB. Policy logic that does not reject input.attributes.request.http.truncated_body can therefore fail open and permit a forbidden payload to reach the protected service, while small bodies and the previously fixed chunked-body case are evaluated normally. This issue is fixed in version 0.27.35.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-65838 https://vulnerability.circl.lu/vuln/ghsa-8qqm-fp2q-v734 <p><strong>Affected:</strong> Go: github.com/zalando/skipper</p> <p>### Summary</p> <p>A wrong policy can be an open door. You have to check `input.attributes.request.http.truncated_body` in your policy.</p> <p>### Description</p> <p>Incomplete fix for CVE-2026-50197: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream.</p> <p>The CVE-2026-50197 fix (commit `3152f3b0`, PR #4041, v0.26.10) substituted `expectedSize = maxBodyBytes` only when `req.ContentLength &lt; 0` (chunked / HTTP/2 without content-length). But when a request declares a `Content-Length` larger than `maxBodyBytes`, `expectedSize &gt; maxBodyBytes`, the body-extraction `if` is skipped entirely, and `ExtractHttpBodyOptionally` returns `rawBodyBytes = nil` — so OPA evaluates an empty `parsed_body`, while the full forbidden payload still flows to the upstream. A deny-on-presence policy (`default allow = true; allow = false if input.parsed_body.&lt;forbidden&gt;`) — the exact Rego shape the advisory describes — fails OPEN. The fix&#39;s own comment reasons only about `ContentLength == -1`; the oversized branch was never considered, and the added PoC test only covers small bodies.</p> <p>### Affected code</p> <p>- `filters/openpolicyagent/openpolicyagent.go` `ExtractHttpBodyOptionally`: the `expectedSize &lt;= maxBodyBytes` gate lets an oversized declared body fall through to `return req.Body, nil, func() {}, nil` (OPA sees an empty document). - Corroborated by Skipper&#39;s own unit test &#34;Read body exhausting max bytes…</p> <p><strong>Affected:</strong> Go: github.com/zalando/skipper</p> <p>### Summary</p> <p>A wrong policy can be an open door. You have to check `input.attributes.request.http.truncated_body` in your policy.</p> <p>### Description</p> <p>Incomplete fix for CVE-2026-50197: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream.</p> <p>The CVE-2026-50197 fix (commit `3152f3b0`, PR #4041, v0.26.10) substituted `expectedSize = maxBodyBytes` only when `req.ContentLength &lt; 0` (chunked / HTTP/2 without content-length). But when a request declares a `Content-Length` larger than `maxBodyBytes`, `expectedSize &gt; maxBodyBytes`, the body-extraction `if` is skipped entirely, and `ExtractHttpBodyOptionally` returns `rawBodyBytes = nil` — so OPA evaluates an empty `parsed_body`, while the full forbidden payload still flows to the upstream. A deny-on-presence policy (`default allow = true; allow = false if input.parsed_body.&lt;forbidden&gt;`) — the exact Rego shape the advisory describes — fails OPEN. The fix&#39;s own comment reasons only about `ContentLength == -1`; the oversized branch was never considered, and the added PoC test only covers small bodies.</p> <p>### Affected code</p> <p>- `filters/openpolicyagent/openpolicyagent.go` `ExtractHttpBodyOptionally`: the `expectedSize &lt;= maxBodyBytes` gate lets an oversized declared body fall through to `return req.Body, nil, func() {}, nil` (OPA sees an empty document). - Corroborated by Skipper&#39;s own unit test &#34;Read body exhausting max bytes…</p> https://vulnerability.circl.lu/vuln/ghsa-8qqm-fp2q-v734