Feast Feature Server
Approved changes feed: RSS · Atom
cpe:2.3:a:feast:feast_feature_server:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Feast (62217dec-14f7-514c-acb6-ed8785c64b46) |
|---|---|
| Product | Feast Feature Server (d4a56329-9030-5700-95d7-b44467c8b39f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-23538 |
vulnerable | 2026-07-29 00:31:59.215819 |
Feast: resource exhaustion via websocket endpoint
HIGH (7.5)
A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources—such as memory, CPU, and file descriptors—leading to a complete denial of service for legitimate users.
Published: 2026-07-16T00:10:50.170Z
Updated: 2026-07-16T13:58:04.495Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23537 |
vulnerable | 2026-07-29 00:31:59.215349 |
Feast: unauthenticated arbitrary file write
CRITICAL (9.1)
A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these protections can be bypassed, enabling an attacker to overwrite vital application configurations or startup scripts. Because this flaw requires no credentials or special privileges, any attacker with network access to the server can potentially compromise the integrity of the system. This could lead to unauthorized system modifications, denial of service through disk exhaustion, or potential remote code execution.
Published: 2026-07-01T13:49:27.306Z
Updated: 2026-07-15T01:18:20.267Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.