# Open Policy Agent (OPA) v1.22.4

> Security · 2026-11-12

A narrowly scoped security patch fixes a Go `net/http` HTTP/1 server crash vulnerability in published OPA binaries and container images. It contains no new operator-facing features or configuration changes.

## Action needed
- **[security]** `CVE-2026-97054` in the Go `net/http` HTTP/1 server
  - This release fixes `CVE-2026-97054` in Go's `net/http` HTTP/1 server. The fix ships in OPA binaries and container images.

[Full analysis](https://ratatosk.io/en/releases/opa/v1.22.4)

[Original release notes](https://github.com/open-policy-agent/opa/releases/tag/v1.22.4)