Affected by GO-2026-4327
and 5 other vulnerabilities
GO-2026-4327: Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper
GO-2026-4378: Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper
GO-2026-5944: Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests in github.com/zalando/skipper
GO-2026-6015: Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS in github.com/zalando/skipper
GO-2026-6018: Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication in github.com/zalando/skipper
GO-2026-6019: Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies in github.com/zalando/skipper
const (
// Name is the filter name// Deprecated, use filters.RfcPathName instead
Name = filters.RfcPathName// NameHost is the filter name// Deprecated, use filters.RfcHostName instead
NameHost = filters.RfcHostName
)
NewPath creates a filter specification for the rfcPath() filter, that
reencodes the reserved characters in the request path, if it detects
that they are encoded in the raw path.
See also the PatchPath documentation in the rfc package.
Affected by 
Documentation
¶
Source Files