CVE-2026-27880: OpenFeature evaluation API reads input data with no bounds
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Configure a WAF, reverse proxy, or API gateway in front of the OpenFeature evaluation endpoint to enforce a maximum request body size and reject requests that exceed that limit, preventing unbounded input from reaching the service.
- Compensating control
Apply network-level protections such as rate limiting and restricting access to the evaluation endpoint to trusted IPs or clients to reduce the chance of large or frequent payloads causing out-of-memory conditions.
- Operational
Monitor memory usage of the OpenFeature evaluation service and configure alerts for elevated memory consumption. Ensure the service or container has appropriate memory limits and is configured to restart on crash so OOM crashes are contained and recovered automatically; investigate and remediate any incidents.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27880?
The severity of CVE-2026-27880 is classified as high due to the potential for out-of-memory crashes.
How do I fix CVE-2026-27880?
To fix CVE-2026-27880, implement input validation to ensure data bounds are enforced in the OpenFeature evaluation API.
Which versions of the OpenFeature evaluation API are affected by CVE-2026-27880?
CVE-2026-27880 affects all versions of the OpenFeature evaluation API that read unbounded input data.
What kind of attacks can CVE-2026-27880 lead to?
CVE-2026-27880 can lead to denial-of-service attacks due to out-of-memory crashes.
Is there a patch available for CVE-2026-27880?
As of now, there is no official patch released for CVE-2026-27880, but it is recommended to monitor for updates from OpenFeature.