CVE-2026-54247: Zalando Skipper memory exhaustion DoS in admission webhook

Executive brief

Zalando Skipper is an HTTP router and reverse proxy for service composition. A vulnerability in its Kubernetes admission webhook allows an attacker to crash the service by sending an excessively large request. This can disrupt the ability to create or update network routing rules within a Kubernetes cluster, though the system typically recovers automatically when the service restarts.

Technical details

The Kubernetes admission webhook handler in Skipper uses `io.ReadAll(r.Body)` without a size limit in `dataclients/kubernetes/admission/admission.go`. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a multi-GB POST request to the admission endpoint (default port 9443), causing the process to be OOM-killed by the kubelet. This affects the admission control for Ingress and RouteGroup resources. The issue is addressed in version 0.26.22 by implementing request body size limits.

Affected products

• Zalando skipper < 0.26.22

Timeline

• 2026-06-05: disclosed
• 2026-06-05: patched: Version 0.26.22 released
• 2026-07-17: advisory

References

• https://api.github.com/users/alcls01111
• https://github.com/alcls01111
• https://api.github.com/users/alcls01111/gists%7B/gist_id%7D
• https://api.github.com/users/alcls01111/repos
• https://avatars.githubusercontent.com/u/57210489?v=4
• https://api.github.com/users/alcls01111/events%7B/privacy%7D