The feature flag daemon flagd processes evaluation requests through its OFREP and gRPC endpoints. An attacker can submit an evaluation request with an arbitrarily large body, and flagd reads the payload into memory without imposing any size limit. This causes the daemon to allocate an equivalent amount of memory, leading to rapid memory exhaustion, process termination, or OOM killing in container environments. The vulnerability is a classic example of uncontrolled resource allocation (CWE-770) and results in denial of service to all clients that rely on the service.

Affected installations are any deployments of open‑feature flagd with a version older than 0.14.2. The flaw exists in both the HTTP/OFREP and gRPC evaluation interfaces, which are by design publicly reachable if the operator does not enforce authentication. Deployments that expose these endpoints to untrusted networks run significant risk of resource exhaustion.

The CVSS score of 7.5 places this issue in the medium‑high range, and the EPSS score indicates it is not among the most frequently exploited vulnerabilities. It is not listed in CISA’s Known Exploited Vulnerabilities catalog. The likely attack vector is an attacker sending a single HTTP or gRPC request from an external network, as the endpoints lack authentication by default. A single malicious request is sufficient to trigger memory exhaustion, so the risk is considerable even in isolated environments.