CVE-2026-54247
Received Received - Intake

Memory Exhaustion in Skipper HTTP Router

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a very large body that causes unbounded memory allocation and an out-of-memory termination of the Skipper process. The disruption is limited to Ingress and RouteGroup admission rather than pod creation or unrelated admission controllers, and Kubernetes normally restarts the process. This issue is fixed in version 0.26.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-54247

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
skipper skipper to 0.26.22 (exc)
zalando skipper to 0.26.22 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Skipper is an HTTP router and reverse proxy. The vulnerability exists in the Kubernetes admission handler where it reads request bodies without size limits. An attacker with network access and a valid Kubernetes client certificate can send a very large request body, causing excessive memory usage and crashing the Skipper process. This leads to an out-of-memory termination.

Detection Guidance

This vulnerability can be detected by monitoring Skipper process memory usage and checking for out-of-memory terminations. Look for processes crashing unexpectedly or Kubernetes restarting Skipper pods. Check logs for admission endpoint errors or large request bodies being processed.

Impact Analysis

The impact is limited to disruption of Ingress and RouteGroup admission in Skipper. The Kubernetes system will automatically restart the process, so the overall cluster remains functional. However, during the outage, admission requests may be delayed or rejected, potentially affecting service routing and access.

Compliance Impact

This vulnerability primarily impacts system availability due to potential denial-of-service conditions caused by unbounded memory consumption. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA compliance. However, prolonged service disruption could indirectly impact compliance by preventing timely processing of requests or logging.

Mitigation Strategies

Upgrade Skipper to version 0.26.22 or later immediately. If upgrading is not possible, restrict network access to the admission endpoint at :9443/admission to trusted sources only. Monitor memory usage closely and set resource limits on Skipper pods to prevent unbounded memory allocation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54247. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart