GO-2026-6495 Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper

Skipper has OPA body-authz bypass: truncatedbody mitigation fails open on chunked/HTTP-2 incomplete fix GHSA-8qqm-fp2q-v734 in github.com/zalando/skipper...

CVE-2026-86043

Skipper (an HTTP router and reverse proxy) has a vulnerability in the opaAuthorizeRequestWithBody filter prior to version 0.27.37 . The truncated_body signal is derived from the Content-Length header rather than the actual read result. When a body is truncated at maxBodyBytes, the header is not u...