opa
v1.22.4Open Policy Agent (OPA) is an open source, general-purpose policy engine.
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 4 advisories3 high, 1 medium · Scorecard 7.9/10
- Supported versions
- No scheduleendoflife.date does not track this project
12.5k stars · 1.8k forks · 270 open issues · last release 3 days ago · data checked 4 hours ago
Breaking changes
What to check before upgrading, taken from the notes of the last 30 releases.
- v1.18.0Jun 25, 2026
Breaking: Fix User-Agent according to RFC9110 (#8792)
OPA's outbound HTTP requests (bundle, discovery, decision log, status,
http.send, AWS KMS/ECR)previously sent
User-Agent: Open Policy Agent/ (, ), which is not a validRFC 9110
User-Agentvalue because theproducttoken cannot contain spaces. The header is nowOpen-Policy-Agent/ (, ). Server-side log filters or WAF rules thatexact-match the old string will need to be updated.
Authored by @sspaink, reported by @SpecLad
Release history
All releases on GitHubThis is a fix release for a vulnerability (CVE-2026-97054) in Go's HTTP/1 server:
https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
> net/http: HTTP/1 server crash due to MaxBytesReader header race
>
> For HTTP/1 servers, when MaxBytesReader's limit is exceeded,
> "Connection: close" header is automatically set without synchronization,
> which might race with another header being set explicitly in the server
> handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or
> MaxBytesHandler can crash due to runtime panic if its handler reads the
> request body concurrently with writing the response header.
>
> Thanks to Jakub Ciolek (https://ciolek.dev) for reporting this issue.
>
> This is CVE-2026-97054 and Go issue https://go.dev/issue/82563.
Note that our security guidance includes not running OPA with its interfaces exposed to adversarial actors, like the public internet. This is fixed regardless, if only to avoid too many spurious vulnerability checker reports.
Also note that if you build your OPA binaries yourself, this patch release does not apply to you, as you control the version of Go that's used. This patch release affects the published binaries and docker images of OPA.