AIKIDO-2025-10970

TL;DR

Affected versions of this package are vulnerable to Memory Exhaustion via a forged Gzip Header. A crafted HTTP request containing a malicious gzip header sent to any of OPA's HTTP endpoints could cause the service to allocate excessive memory, leading to an out-of-memory (OOM) process exit and denial of service. An attacker can exploit this by sending a direct HTTP request to the OPA server, which is effective before any token-based authentication or authorization checks are applied, making it a potent vector if OPA is directly accessible on a network. The issue was addressed by implementing a proper size check on the decompressed payload during gzip handling.