Affected by GO-2026-4327
and 6 other vulnerabilities
GO-2026-4327: Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper
GO-2026-4378: Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper
GO-2026-5944: Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests in github.com/zalando/skipper
GO-2026-6015: Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS in github.com/zalando/skipper
GO-2026-6018: Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication in github.com/zalando/skipper
GO-2026-6019: Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper
GO-2026-6495: Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734) in github.com/zalando/skipper
Package source implements a custom predicate to match routes
based on the Query Params in URL
It supports checking existence of query params and also checking whether
query params value match to a given regular exp
Examples:
// Checking existence of a query param
// matches http://example.org?bb=a&query=withvalue
example1: QueryParam("query") -> "http://example.org";
// Even a query param without a value
// matches http://example.org?bb=a&query=
example1: QueryParam("query") -> "http://example.org";
// matches with regexp
// matches http://example.org?bb=a&query=example
example1: QueryParam("query", "^example$") -> "http://example.org";
// matches with regexp and multiple values of query param
// matches http://example.org?bb=a&query=testing&query=example
example1: QueryParam("query", "^example$") -> "http://example.org";
Affected by 
Documentation
¶
Source Files