The flaw exists in Feast Feature Server’s /ws/chat WebSocket endpoint, where authentication is not required. An attacker can open many long‑lived connections, consuming memory, CPU and file descriptor resources, and ultimately cause the server to become unresponsive to legitimate users. This is a classic resource exhaustion weakness, identified as CWE-770.

The product affected is Feast Feature Server. No specific version information was provided, so any deployment that exposes the /ws/chat endpoint without authentication may be vulnerable.

The CVSS score of 7.5 indicates a high severity risk. Although no exploit probability metric is available, the lack of authentication means the endpoint can be reached remotely with minimal prerequisites. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Given the ability to connect from any network source and the critical impact on availability, the likelihood of exploitation is significant.