{"id":"GO-2026-5944","revision":"2e8e6c5b09f24079afbd2da1ddf63ff9","records":[{"revision":"2e8e6c5b09f24079afbd2da1ddf63ff9","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5944","aliases":["CVE-2026-50197","GHSA-659f-rgp5-w4wf"],"title":"Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests in github.com/zalando/skipper","description":"Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests in github.com/zalando/skipper","state":0,"publishedAt":"2026-07-17T19:42:05+00:00","modifiedAt":"2026-07-21T19:15:27.8000572+00:00","affected":[{"ecosystem":"Go","name":"github.com/zalando/skipper","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.26.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/zalando/skipper/security/advisories/GHSA-659f-rgp5-w4wf"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5944","license":"OSV · upstream source license applies","key":"osv:GO-2026-5944","identifiers":["GO-2026-5944","CVE-2026-50197","GHSA-659f-rgp5-w4wf"]},"retained":false,"historicalAffected":[]}],"coverage":[]}