RATATOSKRATATOSK
Sign in

Open Policy Agent (OPA)

v1.22.4Security
Nov 12, 2026

ACTION 1

A narrowly scoped security patch fixes a Go `net/http` HTTP/1 server crash vulnerability in published OPA binaries and container images. It contains no new operator-facing features or configuration changes.

Action needed (1)

  • securityCVE-2026-97054 in the Go net/http HTTP/1 server

    This release fixes CVE-2026-97054 in Go's net/http HTTP/1 server. The fix ships in OPA binaries and container images.

Add Open Policy Agent (OPA) to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Open Policy Agent (OPA) releases →