CVE-2026-31866 Details

A denial-of-service vulnerability has been identified in flagd, a feature flag daemon, in versions prior to 0.14.2. The issue arises because flagd's OFREP and gRPC endpoints for feature flag evaluation do not impose any size restrictions on the evaluation context included in request payloads. This lack of restriction allows an attacker to send a single HTTP request with an excessively large body, causing flagd to allocate a corresponding amount of memory. The result is immediate memory exhaustion and process termination, such as an OOMKill in Kubernetes environments. Additionally, flagd's evaluation endpoints do not natively enforce authentication, leaving them vulnerable to exploitation unless protected by an external reverse proxy or similar infrastructure.

Users can upgrade to flagd version 0.14.2 or later, where this vulnerability has been fixed. Instructions for updating can be found in the flagd repository on GitHub.