What’s Vulnerable › Vulnerabilities

CVE-2022-33082

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-06-30 · updated 2026-06-17

Description

An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Affected products

• Openpolicyagent Open Policy Agent: before 0.42.0 — fixed in 0.42.0

How to fix

Upgrade to a fixed version: Openpolicyagent Open Policy Agent 0.42.0. Check the vendor advisory for mitigations.

References

• https://github.com/open-policy-agent/opa/blob/598176de326025451025225aca53e85708d5f1db/ast/compile.go#L1224
• https://github.com/open-policy-agent/opa/blob/598176de326025451025225aca53e85708d5f1db/ast/compile.go#L1224

Get alerted when CVE-2022-33082 or the next vulnerability affects your stack