CVE-2026-54247: CWE-770: Allocation of Resources Without Limits or Throttling in zalando skipper
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a very large body that causes unbounded memory allocation and an out-of-memory termination of the Skipper process. The disruption is limited to Ingress and RouteGroup admission rather than pod creation or unrelated admission controllers, and Kubernetes normally restarts the process. This issue is fixed in version 0.26.22.
AI Analysis
Technical Summary
Zalando Skipper versions before 0.26.22 contain a resource allocation vulnerability (CWE-770) in the Kubernetes admission handler. The handler reads the request body without imposing a size limit, allowing an attacker with appropriate in-cluster access and credentials to send a very large request body. This causes unbounded memory allocation leading to out-of-memory termination of the Skipper process. The disruption affects only Ingress and RouteGroup admission controllers, not pod creation or other admission controllers. The vulnerability is addressed by limiting request body size in version 0.26.22.
Potential Impact
An attacker with in-cluster network access and a valid Kubernetes client certificate can cause the Skipper process to consume excessive memory and terminate unexpectedly. This results in denial of service for the Ingress and RouteGroup admission controllers. Kubernetes typically restarts the terminated Skipper process, limiting the disruption duration. There is no impact on confidentiality or integrity, only availability.
Mitigation Recommendations
Upgrade Zalando Skipper to version 0.26.22 or later where this issue is fixed. The fix imposes a size limit on request bodies passed to the Kubernetes admission endpoint, preventing unbounded memory allocation. No other mitigation is required as the vulnerability is resolved by the official patch.
CVE-2026-54247: CWE-770: Allocation of Resources Without Limits or Throttling in zalando skipper
Description
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a very large body that causes unbounded memory allocation and an out-of-memory termination of the Skipper process. The disruption is limited to Ingress and RouteGroup admission rather than pod creation or unrelated admission controllers, and Kubernetes normally restarts the process. This issue is fixed in version 0.26.22.
CVSS v3.1
Score 4.3medium
Affected software
zalando
skipper
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Zalando Skipper versions before 0.26.22 contain a resource allocation vulnerability (CWE-770) in the Kubernetes admission handler. The handler reads the request body without imposing a size limit, allowing an attacker with appropriate in-cluster access and credentials to send a very large request body. This causes unbounded memory allocation leading to out-of-memory termination of the Skipper process. The disruption affects only Ingress and RouteGroup admission controllers, not pod creation or other admission controllers. The vulnerability is addressed by limiting request body size in version 0.26.22.
Potential Impact
An attacker with in-cluster network access and a valid Kubernetes client certificate can cause the Skipper process to consume excessive memory and terminate unexpectedly. This results in denial of service for the Ingress and RouteGroup admission controllers. Kubernetes typically restarts the terminated Skipper process, limiting the disruption duration. There is no impact on confidentiality or integrity, only availability.
Mitigation Recommendations
Upgrade Zalando Skipper to version 0.26.22 or later where this issue is fixed. The fix imposes a size limit on request bodies passed to the Kubernetes admission endpoint, preventing unbounded memory allocation. No other mitigation is required as the vulnerability is resolved by the official patch.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-12T16:25:43.085Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa8567155bf5e2cf58d7f01
Added to database: 09/14/2026, 20:17:53 UTC
Last enriched: 09/14/2026, 20:32:19 UTC
Last updated: 09/15/2026, 00:46:15 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.