CVE-2026-31866 Allocation of Resources Without Limits or Throttling in flagd
An attacker can cause denial of service in flagd by sending large payloads to evaluation endpoints, exhausting memory and crashing the process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31866?
CVE-2026-31866 is a high-severity denial of service vulnerability in open-feature flagd, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
flagd is a feature flag daemon with a Unix philosophy. Prior to 0.14.2, flagd exposes OFREP (/ofrep/v1/evaluate/...) and gRPC (evaluation.v1, evaluation.v2) endpoints for feature flag evaluation. These endpoints are designed to be publicly accessible by client applications. The evaluation context included in request payloads is read into memory without any size restriction. An attacker can send a single HTTP request with an arbitrarily large body, causing flagd to allocate a corresponding amount of memory. This leads to immediate memory exhaustion and process termination (e.g., OOMKill in Kubernetes environments). flagd does not natively enforce authentication on its evaluation endpoints. While operators may deploy flagd behind an authenticating reverse proxy or similar infrastructure, the endpoints themselves impose no access control by default. This vulnerability is fixed in 0.14.2.
Weakness: CWE-770
Which versions are affected by CVE-2026-31866?
3 open source packages ship an affected version, including github.com/open-feature/flagd/flagd. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/open-feature/flagd/flagd Go | All versions | 0.14.2 |
github.com/open-feature/flagd/flagd Go | All versions | 0.14.2 |
github.com/open-feature/flagd/flagd Go | All versions | 0.14.2 |
Products include Openfeature Flagd.
How do I fix CVE-2026-31866?
Upgrade github.com/open-feature/flagd/flagd to 0.14.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-31866 being exploited?
There is no known exploitation of CVE-2026-31866 in the wild and no public exploit code.
Sources
Also known as GHSA-rmrf-g9r3-73pm, GO-2026-4674.