v1.14.0
2026-03-04T22:22:37Z•e751d1acdf789a610caa8e010fec350bef82702cf635e4b0c88f1109e815f0c1
GO-2026-4337GoOPAarray.flattenbundledecision-logsdenial-of-servicegziphttp-endpointsmemory-exhaustionopen-policy-agentregorelease-notesrule-indexingstring-interpolationupdate-recommendedvulnerability
What happened
Open Policy Agent (OPA) release notes v1.11.0 through v1.14.0. Key security-relevant items: v1.11.1 fixes a denial-of-service (memory exhaustion / OOM) via crafted gzip headers sent to OPA HTTP endpoints (exploitable prior to token-based auth and thus requires network access to OPA). v1.13.2 updates Go to 1.25.7 to include the fix for GO-2026-4337. Other releases contain functional and correctness fixes (array.flatten, string interpolation, decision-logger/bundle reconfiguration, rule indexing improvements) and various performance and tooling changes. Operators should upgrade to the patched OP
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- open_policy_agent_opa_releases
- Record identifier
- e751d1acdf789a610caa8e010fec350bef82702cf635e4b0c88f1109e815f0c1
- Enrichment time
- 2026-03-04T22:22:37Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.