CVE-2026-54247

Name of the Vulnerable Software and Affected Versions Skipper (affected versions not specified)

Description The Kubernetes admission webhook handler reads the entire request body without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a multi-GB payload to the /admission endpoint, causing the process to exhaust memory and be OOM-killed (Out Of Memory killed). This results in a denial of service that disrupts admission control for Ingress and RouteGroup resources until the process is automatically restarted. The issue occurs because the io.ReadAll(r.Body) function is used without implementing a maximum byte reader or size restriction.

Recommendations Implement a body size limit using http.MaxBytesReader or a similar mechanism before reading the request body. Define a maximum request body size, such as a DefaultMaxRequestBodySize constant, and utilize a buffered reader to enforce this limit. Introduce a configurable --admission-max-body-size flag to allow administrators to define the memory limit for admission requests.