VYPR
← All advisories
High severityNVD Advisory· Published May 19, 2022· Updated Aug 3, 2024

CVE-2022-28946

CVE-2022-28946

Description

An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Open Policy Agent v0.39.0 contains a parsing bug in ast/parser.go that causes out-of-range memory access and denial of service via crafted Rego expressions.

Vulnerability

A flaw in the Go file ast/parser.go of Open Policy Agent (OPA) v0.39.0 causes the parser to incorrectly handle crafted expressions involving some or every quantifiers with invalid domain arguments (e.g., some internal.member_2()). The parser transforms some x in xs into internal.member_2(x, xs), and when the expected two or three arguments are missing, it triggers out-of-range memory access, leading to a denial of service. This affects OPA v0.39.0 [1][3][4].

Exploitation

An attacker must craft a Rego policy or data file containing an expression like some internal.member_2() and provide it to an OPA instance that parses the policy. No authentication or special network access is required if the attacker can supply a policy (e.g., via the OPA API or bundled data). The parsing step alone triggers the out-of-bounds access, causing a crash [1][3].

Impact

Successful exploitation results in a denial of service (DoS) as the OPA process crashes upon parsing the malicious expression. No information is disclosed, and no further privilege escalation occurs — the impact is limited to availability of the policy engine [1][3][4].

Mitigation

The fix was merged in pull request #4548 and is available in OPA releases after v0.39.0; users should upgrade to a patched version. No workarounds are documented. The advisory is tracked as GO-2022-0587 in the Go vulnerability database [3][4].

References
  1. NVD - CVE-2022-28946
  2. ast/parser: guard against invalid domains for "some" and "every" by srenatus · Pull Request #4548 · open-policy-agent/opa
  3. GO-2022-0587 - Go Packages

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/open-policy-agent/opaGo
< 0.40.00.40.0

Affected products

10

Patches

1
e9d3828db670

ast/parser: guard against invalid domains for "some" and "every" (#4548)

https://github.com/open-policy-agent/opaStephan RenatusApr 5, 2022via ghsa
commit
2 files changed · +24 −1
  • ast/parser.go+18 −1 modified
    @@ -897,7 +897,16 @@ func (p *Parser) parseSome() *Expr {
 	if term := p.parseTermInfixCall(); term != nil {
 		if call, ok := term.Value.(Call); ok {
 			switch call[0].String() {
-			case Member.Name, MemberWithKey.Name: // OK
+			case Member.Name:
+				if len(call) != 3 {
+					p.illegal("illegal domain")
+					return nil
+				}
+			case MemberWithKey.Name:
+				if len(call) != 4 {
+					p.illegal("illegal domain")
+					return nil
+				}
 			default:
 				p.illegal("expected `x in xs` or `x, y in xs` expression")
 				return nil
@@ -972,9 +981,17 @@ func (p *Parser) parseEvery() *Expr {
 	}
 	switch call[0].String() {
 	case Member.Name: // x in xs
+		if len(call) != 3 {
+			p.illegal("illegal domain")
+			return nil
+		}
 		qb.Value = call[1]
 		qb.Domain = call[2]
 	case MemberWithKey.Name: // k, v in xs
+		if len(call) != 4 {
+			p.illegal("illegal domain")
+			return nil
+		}
 		qb.Key = call[1]
 		qb.Value = call[2]
 		qb.Domain = call[3]
  • ast/parser_test.go+6 −0 modified
    @@ -785,6 +785,10 @@ func TestSomeDeclExpr(t *testing.T) {
 			},
 			With: []*With{{Value: ArrayTerm(), Target: NewTerm(MustParseRef("input"))}},
 		}, opts)
+
+	assertParseErrorContains(t, "invalid domain (internal.member_2)", "some internal.member_2()", "illegal domain", opts)
+	assertParseErrorContains(t, "invalid domain (internal.member_3)", "some internal.member_3()", "illegal domain", opts)
+
 }
 
 func TestEvery(t *testing.T) {
@@ -851,6 +855,8 @@ func TestEvery(t *testing.T) {
 		"unexpected ident token: expected \\n or ; or }\n\tevery x\n", // this asserts that the tail of the error message doesn't contain a hint
 	)
 
+	assertParseErrorContains(t, "invalid domain (internal.member_2)", "every internal.member_2()", "illegal domain", opts)
+	assertParseErrorContains(t, "invalid domain (internal.member_3)", "every internal.member_3()", "illegal domain", opts)
 }
 
 func TestNestedExpressions(t *testing.T) {

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.