CVE-2026-31866

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31866", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-09T19:02:25.013Z", "datePublished": "2026-03-11T17:49:48.520Z", "dateUpdated": "2026-03-12T13:50:21.906Z"}, "containers": {"cna": {"title": "Allocation of Resources Without Limits or Throttling in flagd", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/open-feature/flagd/security/advisories/GHSA-rmrf-g9r3-73pm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/open-feature/flagd/security/advisories/GHSA-rmrf-g9r3-73pm"}, {"name": "https://github.com/open-feature/flagd/commit/25c5fd7e80c26eb2c00b20317b2456fe6f927ea3", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-feature/flagd/commit/25c5fd7e80c26eb2c00b20317b2456fe6f927ea3"}], "affected": [{"vendor": "open-feature", "product": "flagd", "versions": [{"version": "< 0.14.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T17:49:48.520Z"}, "descriptions": [{"lang": "en", "value": "flagd is a feature flag daemon with a Unix philosophy. Prior to 0.14.2, flagd exposes OFREP (/ofrep/v1/evaluate/...) and gRPC (evaluation.v1, evaluation.v2) endpoints for feature flag evaluation. These endpoints are designed to be publicly accessible by client applications. The evaluation context included in request payloads is read into memory without any size restriction. An attacker can send a single HTTP request with an arbitrarily large body, causing flagd to allocate a corresponding amount of memory. This leads to immediate memory exhaustion and process termination (e.g., OOMKill in Kubernetes environments). flagd does not natively enforce authentication on its evaluation endpoints. While operators may deploy flagd behind an authenticating reverse proxy or similar infrastructure, the endpoints themselves impose no access control by default. This vulnerability is fixed in 0.14.2."}], "source": {"advisory": "GHSA-rmrf-g9r3-73pm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T13:50:14.073092Z", "id": "CVE-2026-31866", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T13:50:21.906Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31866", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T13:50:14.073092Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T13:50:18.423Z"}}], "cna": {"title": "Allocation of Resources Without Limits or Throttling in flagd", "source": {"advisory": "GHSA-rmrf-g9r3-73pm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "open-feature", "product": "flagd", "versions": [{"status": "affected", "version": "< 0.14.2"}]}], "references": [{"url": "https://github.com/open-feature/flagd/security/advisories/GHSA-rmrf-g9r3-73pm", "name": "https://github.com/open-feature/flagd/security/advisories/GHSA-rmrf-g9r3-73pm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/open-feature/flagd/commit/25c5fd7e80c26eb2c00b20317b2456fe6f927ea3", "name": "https://github.com/open-feature/flagd/commit/25c5fd7e80c26eb2c00b20317b2456fe6f927ea3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "flagd is a feature flag daemon with a Unix philosophy. Prior to 0.14.2, flagd exposes OFREP (/ofrep/v1/evaluate/...) and gRPC (evaluation.v1, evaluation.v2) endpoints for feature flag evaluation. These endpoints are designed to be publicly accessible by client applications. The evaluation context included in request payloads is read into memory without any size restriction. An attacker can send a single HTTP request with an arbitrarily large body, causing flagd to allocate a corresponding amount of memory. This leads to immediate memory exhaustion and process termination (e.g., OOMKill in Kubernetes environments). flagd does not natively enforce authentication on its evaluation endpoints. While operators may deploy flagd behind an authenticating reverse proxy or similar infrastructure, the endpoints themselves impose no access control by default. This vulnerability is fixed in 0.14.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-11T17:49:48.520Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31866", "state": "PUBLISHED", "dateUpdated": "2026-03-12T13:50:21.906Z", "dateReserved": "2026-03-09T19:02:25.013Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-11T17:49:48.520Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "flagd", "vendor": "open-feature", "versions": [{"status": "affected", "version": "< 0.14.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openfeature:flagd:*:*:*:*:*:*:*:*", "matchCriteriaId": "679B3F85-E0E4-4438-907F-AB82EEF05BD6", "versionEndExcluding": "0.14.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "flagd is a feature flag daemon with a Unix philosophy. Prior to 0.14.2, flagd exposes OFREP (/ofrep/v1/evaluate/...) and gRPC (evaluation.v1, evaluation.v2) endpoints for feature flag evaluation. These endpoints are designed to be publicly accessible by client applications. The evaluation context included in request payloads is read into memory without any size restriction. An attacker can send a single HTTP request with an arbitrarily large body, causing flagd to allocate a corresponding amount of memory. This leads to immediate memory exhaustion and process termination (e.g., OOMKill in Kubernetes environments). flagd does not natively enforce authentication on its evaluation endpoints. While operators may deploy flagd behind an authenticating reverse proxy or similar infrastructure, the endpoints themselves impose no access control by default. This vulnerability is fixed in 0.14.2."}, {"lang": "es", "value": "flagd es un demonio de feature flags con una filosof\u00eda Unix. Antes de la versi\u00f3n 0.14.2, flagd expone puntos finales OFREP (/ofrep/v1/evaluate/...) y gRPC (evaluation.v1, evaluation.v2) para la evaluaci\u00f3n de feature flags. Estos puntos finales est\u00e1n dise\u00f1ados para ser accesibles p\u00fablicamente por aplicaciones cliente. El contexto de evaluaci\u00f3n incluido en las cargas \u00fatiles de las solicitudes se lee en la memoria sin ninguna restricci\u00f3n de tama\u00f1o. Un atacante puede enviar una \u00fanica solicitud HTTP con un cuerpo arbitrariamente grande, haciendo que flagd asigne una cantidad de memoria correspondiente. Esto conduce a un agotamiento inmediato de la memoria y a la terminaci\u00f3n del proceso (por ejemplo, OOMKill en entornos Kubernetes). flagd no aplica de forma nativa la autenticaci\u00f3n en sus puntos finales de evaluaci\u00f3n. Si bien los operadores pueden desplegar flagd detr\u00e1s de un proxy inverso autenticador o infraestructura similar, los propios puntos finales no imponen ning\u00fan control de acceso por defecto. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.14.2."}], "id": "CVE-2026-31866", "lastModified": "2026-06-17T10:34:39.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31866", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T13:50:14.073092Z", "version": "2.0.3"}}]}, "published": "2026-03-11T18:16:25.460", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/open-feature/flagd/commit/25c5fd7e80c26eb2c00b20317b2456fe6f927ea3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/open-feature/flagd/security/advisories/GHSA-rmrf-g9r3-73pm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.14.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "flagd", "source": "cna", "vendor": "open-feature"}, "product": "flagd", "vendor": "open-feature"}], "analysis": {"en": {"generated_at": "2026-03-20T17:54:41.154296+00:00", "value": {"mitigation_remediation": ["Upgrade flagd to version 0.14.2 or later", "If an upgrade cannot be applied immediately, place flagd behind a reverse proxy that limits request size or enforces authentication to prevent large payloads from reaching the daemon", "Monitor memory usage of the flagd process and set alerts for unusual spikes that could indicate abuse"], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via Memory Exhaustion"}, "threat_synthesis": {"affected_systems": "Affected installations are any deployments of open\u2011feature flagd with a version older than 0.14.2. The flaw exists in both the HTTP/OFREP and gRPC evaluation interfaces, which are by design publicly reachable if the operator does not enforce authentication. Deployments that expose these endpoints to untrusted networks run significant risk of resource exhaustion.", "description_and_impact": "The feature flag daemon flagd processes evaluation requests through its OFREP and gRPC endpoints. An attacker can submit an evaluation request with an arbitrarily large body, and flagd reads the payload into memory without imposing any size limit. This causes the daemon to allocate an equivalent amount of memory, leading to rapid memory exhaustion, process termination, or OOM killing in container environments. The vulnerability is a classic example of uncontrolled resource allocation (CWE-770) and results in denial of service to all clients that rely on the service.", "risk_and_exploitability": "The CVSS score of 7.5 places this issue in the medium\u2011high range, and the EPSS score indicates it is not among the most frequently exploited vulnerabilities. It is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. The likely attack vector is an attacker sending a single HTTP or gRPC request from an external network, as the endpoints lack authentication by default. A single malicious request is sufficient to trigger memory exhaustion, so the risk is considerable even in isolated environments."}}}}, "created": "2026-03-12T09:57:31.967572+00:00", "updated": "2026-03-23T09:55:19.384468+00:00", "vendors": ["open-feature", "open-feature$PRODUCT$flagd"]}