Is CVE-2026-54247 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54247 being exploited in the wild.

How severe is CVE-2026-54247?

Medium severity, with a CVSS score of 4.3, published 14 September 2026.

Which products and versions are affected?

github.com/zalando/skipper (Go) < 0.26.22, SEMVER:introduced=0,fixed=0.26.22; Zalando Skipper < 0.26.22.

Is there a fix for CVE-2026-54247?

Yes. github.com/zalando/skipper (Go): upgrade to 0.26.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54247 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54247?

Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54247: Zalando Skipper memory exhaustion DoS in admission webhook

Q: Is there a fix for CVE-2026-54247?

Yes. github.com/zalando/skipper (Go): upgrade to 0.26.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54247 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54247?

Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54247 · Severity: medium · CVSS 4.3 · Published 2026-09-14

Zalando Skipper is an HTTP router and reverse proxy for service composition. A vulnerability in its Kubernetes admission webhook allows an attacker to crash the service by sending an excessively large request. This can disrupt the ability to create or update network routing rules within a Kubernetes cluster, though the system typically recovers automatically when the service restarts.

Technologies: github.com/zalando/skipper (Go), Zalando Skipper. Vendors: Go, Zalando.

Quick answers

Is CVE-2026-54247 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54247 being exploited in the wild.
How severe is CVE-2026-54247?: Medium severity, with a CVSS score of 4.3, published 14 September 2026.
Which products and versions are affected?: github.com/zalando/skipper (Go) < 0.26.22, SEMVER:introduced=0,fixed=0.26.22; Zalando Skipper < 0.26.22.
Is there a fix for CVE-2026-54247?: Yes. github.com/zalando/skipper (Go): upgrade to 0.26.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54247 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54247?: Check whether you run github.com/zalando/skipper (Go) or Zalando Skipper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/zalando/skipper (Go): upgrade to 0.26.22 or later
```
go get github.com/zalando/skipper@v0.26.22
```

Technical details

The Kubernetes admission webhook handler in Skipper uses `io.ReadAll(r.Body)` without a size limit in `dataclients/kubernetes/admission/admission.go`. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a multi-GB POST request to the admission endpoint (default port 9443), causing the process to be OOM-killed by the kubelet. This affects the admission control for Ingress and RouteGroup resources. The issue is addressed in version 0.26.22 by implementing request body size limits.

Affected products

Zalando skipper < 0.26.22

Identifiers

CVE-2026-54247
GHSA-cwxq-rc9x-2jvv
GO-2026-6015

Timeline

2026-06-05: disclosed
2026-06-05: patched: Version 0.26.22 released
2026-07-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.