CVE-2026-31866

CVE-2026-31866 impacts openfeature flagd versions prior to 0.14.2, where publicly accessible evaluation endpoints are vulnerable to a denial-of-service (DoS) attack. An unauthenticated attacker can send a single HTTP request with an arbitrarily large body, causing memory exhaustion and process termination (OOMKill) due to unrestricted memory allocation. This vulnerability has a CVSS score of 7.5 HIGH, indicating a critical impact on availability with no confidentiality or integrity concerns. The attack vector is network-based with low complexity and requires no privileges or user interaction. There is currently no evidence of active exploitation, nor are public exploit modules available, and community attention remains low.