Allocation of Resources Without Limits or Throttling in flagd
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
flagd is a feature flag daemon with a Unix philosophy. Prior to 0.14.2, flagd exposes OFREP (/ofrep/v1/evaluate/...) and gRPC (evaluation.v1, evaluation.v2) endpoints for feature flag evaluation. These endpoints are designed to be publicly accessible by client applications. The evaluation context included in request payloads is read into memory without any size restriction. An attacker can send a single HTTP request with an arbitrarily large body, causing flagd to allocate a corresponding amount of memory. This leads to immediate memory exhaustion and process termination (e.g., OOMKill in Kubernetes environments). flagd does not natively enforce authentication on its evaluation endpoints. While operators may deploy flagd behind an authenticating reverse proxy or similar infrastructure, the endpoints themselves impose no access control by default. This vulnerability is fixed in 0.14.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-feature | flagd | before 0.14.2 | 0.14.2 | Patch available | CNA |
| — | github.com/open-feature/flagd/flagd (Go) | before 0.14.2 | 0.14.2 | Patch available | GHSA-rmrf-g9r3-73pm |
- flagd Vendoropen-feature Affected before 0.14.2 Fixed in 0.14.2 Patch available CNA
- github.com/open-feature/flagd/flagd (Go) Vendor— Affected before 0.14.2 Fixed in 0.14.2 Patch available GHSA-rmrf-g9r3-73pm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openfeature:flagd:*:*:*:*:*:*:*:* | before 0.14.2 | Vulnerable | open-feature |
- cpe:2.3:a:openfeature:flagd:*:*:*:*:*:*:*:* Versions before 0.14.2 Vulnerable ·open-feature
Remediation
- Fix · CNA flagd (open-feature) Fixed in 0.14.2
- Fix · GHSA-rmrf-g9r3-73pm github.com/open-feature/flagd/flagd (Go) Fixed in 0.14.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-31866
- 2026-10-03 Alias added: GHSA-rmrf-g9r3-73pm
- 2026-10-25 Priority changed: MEDIUM → LOW
References
Sources
- CVE-2026-31866 · CVE Program
- CVE-2026-31866 · NVD
- FIRST EPSS
- GHSA-rmrf-g9r3-73pm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences