https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:16:11 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-50197 <p>Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper&#39;s OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the opaAuthorizeRequestWithBody filter and OpenPolicyAgentInstance.ExtractHttpBodyOptionally in filters/openpolicyagent/openpolicyagent.go produce an empty raw_body and input.parsed_body while the upstream service receives the full attacker-controlled body. This issue is fixed in version 0.26.10.</p> <p>Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper&#39;s OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the opaAuthorizeRequestWithBody filter and OpenPolicyAgentInstance.ExtractHttpBodyOptionally in filters/openpolicyagent/openpolicyagent.go produce an empty raw_body and input.parsed_body while the upstream service receives the full attacker-controlled body. This issue is fixed in version 0.26.10.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-50197 https://vulnerability.circl.lu/vuln/ghsa-659f-rgp5-w4wf <p><strong>Affected:</strong> Go: github.com/zalando/skipper</p> <p>### Summary</p> <p>`zalando/skipper`&#39;s OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 `Transfer-Encoding: chunked` and HTTP/2 requests that omit the `content-length` pseudo-header. When the `opaAuthorizeRequestWithBody` filter is configured, the `OpenPolicyAgentInstance.ExtractHttpBodyOptionally` helper produces an empty `raw_body` for any request whose `Content-Length` header is missing, while the underlying chunked body still flows through to the upstream service. Rego policies that gate on `input.parsed_body` (e.g. &#34;deny when a forbidden field is present&#34;) evaluate against an empty document, treat the forbidden field as absent, and authorize the request. The upstream handler then receives the full attacker payload that the policy intended to block.</p> <p>### Affected versions</p> <p>`github.com/zalando/skipper` versions `&lt;= v0.26.8` (the latest release on 2026-05-26, current `master` `4eed47ff`). The vulnerable helper and gate have lived in `filters/openpolicyagent/openpolicyagent.go` since the buffered-body extractor was introduced; no released version contains the fix at the time of filing.</p> <p>### Privilege required</p> <p>Unauthenticated network access to the skipper proxy listener. The threat model targets operators who place skipper in front of a private upstream and rely on `opaAuthorizeRequestWithBody` to enforce body-content checks (field allow/deny lists, payload schema gates, content-moderation flags, multi-tenant per-action authorization). Both HTTP/1…</p> <p><strong>Affected:</strong> Go: github.com/zalando/skipper</p> <p>### Summary</p> <p>`zalando/skipper`&#39;s OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 `Transfer-Encoding: chunked` and HTTP/2 requests that omit the `content-length` pseudo-header. When the `opaAuthorizeRequestWithBody` filter is configured, the `OpenPolicyAgentInstance.ExtractHttpBodyOptionally` helper produces an empty `raw_body` for any request whose `Content-Length` header is missing, while the underlying chunked body still flows through to the upstream service. Rego policies that gate on `input.parsed_body` (e.g. &#34;deny when a forbidden field is present&#34;) evaluate against an empty document, treat the forbidden field as absent, and authorize the request. The upstream handler then receives the full attacker payload that the policy intended to block.</p> <p>### Affected versions</p> <p>`github.com/zalando/skipper` versions `&lt;= v0.26.8` (the latest release on 2026-05-26, current `master` `4eed47ff`). The vulnerable helper and gate have lived in `filters/openpolicyagent/openpolicyagent.go` since the buffered-body extractor was introduced; no released version contains the fix at the time of filing.</p> <p>### Privilege required</p> <p>Unauthenticated network access to the skipper proxy listener. The threat model targets operators who place skipper in front of a private upstream and rely on `opaAuthorizeRequestWithBody` to enforce body-content checks (field allow/deny lists, payload schema gates, content-moderation flags, multi-tenant per-action authorization). Both HTTP/1…</p> https://vulnerability.circl.lu/vuln/ghsa-659f-rgp5-w4wf