CVE Intelligence

Vulnerabilidades do Feast Feast Feature Server

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Feast Feast Feature Server: 2 registro(s), com versões afetadas e correções.

CVE-2026-23538 Alta · 7.5 CWE-770 15/07/2026
Feast: resource exhaustion via websocket endpoint
A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources—such as memory, CPU, and file descriptors—leading to a complete denial of service for legitimate users.
CVE-2026-23537 Crítica · 9.1 CWE-862 01/07/2026
Feast: unauthenticated arbitrary file write
A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these protections can be bypassed, enabling an attacker to overwrite vital application configurations or startup scripts. Because this flaw requires no credentials or special privileges, any attacker with network access to the server can potentially compromise the integrity of the system. This could lead to unauthorized system modifications, denial of service through disk exhaustion, or potential remote code execution.