How severe is CVE-2022-28946?

CVE-2022-28946 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2022-28946 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-28946?

CVE-2022-28946 affects Openpolicyagent Open Policy Agent. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-28946?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2022-28946 published?

CVE-2022-28946 was published on 2022-05-19 and last updated on 2026-06-17.

CVE-2022-28946

CVE-2022-28946 is a high-severity vulnerability in Openpolicyagent Open Policy Agent with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 1% (57th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Openpolicyagent Open Policy Agent
Published: 2022-05-19
Last modified: 2026-06-17

Description

An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.

Frequently asked questions

What is CVE-2022-28946?: An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.
How severe is CVE-2022-28946?: CVE-2022-28946 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2022-28946 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (57th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-28946?: CVE-2022-28946 affects Openpolicyagent Open Policy Agent. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-28946?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2022-28946 published?: CVE-2022-28946 was published on 2022-05-19 and last updated on 2026-06-17.

References

https://github.com/open-policy-agent/opa/commit/e9d3828db670cbe11129885f37f08cbf04935264

Affected products (1)

cpe:2.3:a:openpolicyagent:open_policy_agent:0.39.0:*:*:*:*:*:*:*

More vulnerabilities in Openpolicyagent Open Policy Agent

CVE-2022-33082 — High (CVSS 7.5): An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service…
CVE-2022-36085 — High (CVSS 7.4): Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated)…
CVE-2022-23628 — Medium (CVSS 6.3): OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree…
CVE-2024-8260 — Medium (CVSS 6.1): A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability…

All CVEs affecting Openpolicyagent Open Policy Agent →