Executive brief
Skipper is an HTTP reverse proxy that uses Open Policy Agent (OPA) to authorize requests based on their body content. The previous mitigation against oversized request bodies relies on an OPA field called `truncated_body`, which informs policies whether the request body was truncated during inspection. However, this flag is only set when a Content-Length header is present. Requests sent with chunked transfer encoding or over HTTP/2 (which lack Content-Length) are incorrectly marked as not truncated, allowing large payloads to bypass authorization checks and reach the protected upstream service in full.
Technical details
This vulnerability is an incomplete fix of GHSA-8qqm-fp2q-v734. The root cause lies in how the OPA Envoy plugin (`opa-envoy-plugin`) computes the `truncated_body` flag in `envoyauth/request.go`. The function `getParsedBody()` only checks for body truncation when a `content-length` header is present; for chunked transfer encoding or HTTP/2 requests that lack this header, it returns `truncated_body = false` by default. Meanwhile, Skipper's `ExtractHttpBodyOptionally()` *does* truncate the body when it exceeds `max-request-body-size`. An attacker can send an oversized request body using `Transfer-Encoding: chunked` (HTTP/1.1) or over HTTP/2, which will be truncated by Skipper but reported to OPA as not truncated. A policy following the advisory's mitigation (`allow if input.truncated_body == false`) will incorrectly authorize the request, and Skipper will forward the full, uninspected payload to the upstream. No authentication or special conditions are required; a single crafted request suffices.
Affected products
- Zalando Skipper <= 0.27.33
Timeline
- 2026-09-17: disclosed: GHSA-5gpm-rgj3-9q76 advisory published