How severe is CVE-2022-33082?

CVE-2022-33082 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2022-33082 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-33082?

CVE-2022-33082 affects Openpolicyagent Open Policy Agent. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-33082?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2022-33082 published?

CVE-2022-33082 was published on 2022-06-30 and last updated on 2026-06-17.

CVE-2022-33082

CVE-2022-33082 is a high-severity vulnerability in Openpolicyagent Open Policy Agent with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 2% (74th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Openpolicyagent Open Policy Agent
Published: 2022-06-30
Last modified: 2026-06-17

Description

An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Frequently asked questions

What is CVE-2022-33082?: An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.
How severe is CVE-2022-33082?: CVE-2022-33082 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2022-33082 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (74th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-33082?: CVE-2022-33082 affects Openpolicyagent Open Policy Agent. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-33082?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2022-33082 published?: CVE-2022-33082 was published on 2022-06-30 and last updated on 2026-06-17.

References

https://github.com/open-policy-agent/opa/blob/598176de326025451025225aca53e85708d5f1db/ast/compile.go#L1224

Affected products (1)

cpe:2.3:a:openpolicyagent:open_policy_agent:*:*:*:*:*:*:*:*

More vulnerabilities in Openpolicyagent Open Policy Agent

CVE-2022-28946 — High (CVSS 7.5): An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret…
CVE-2022-36085 — High (CVSS 7.4): Open Policy Agent (OPA) is an open source, general-purpose policy engine. The Rego compiler provides a (deprecated)…
CVE-2022-23628 — Medium (CVSS 6.3): OPA is an open source, general-purpose policy engine. Under certain conditions, pretty-printing an abstract syntax tree…
CVE-2024-8260 — Medium (CVSS 6.1): A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability…

All CVEs affecting Openpolicyagent Open Policy Agent →