{"id":"CVE-2026-23538","aliases":["EUVD-2026-44838","GHSA-gmv6-fcfc-3372"],"status":"published","title":"Feast: resource exhaustion via websocket endpoint","description":"A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources—such as memory, CPU, and file descriptors—leading to a complete denial of service for legitimate users.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00894,"percentile":0.59912,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-770"],"published":"2026-07-16T00:10:50Z","modified":"2026-07-16T14:16:49Z","products":[{"vendor":"feast","product":"feast feature server"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-23538","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2429311","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/red-hat-data-services/feast/pull/192"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23538.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23538"},{"url":"https://github.com/advisories/GHSA-gmv6-fcfc-3372"}],"sources":{"cve":[{"id":"CVE-2026-23538","title":"Feast: resource exhaustion via websocket endpoint","description":"A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources—such as memory, CPU, and file descriptors—leading to a complete denial of service for legitimate users.","status":"published","published":"2026-07-16T00:10:50.17Z","modified":"2026-07-16T13:58:04.495Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770","CWE-770"],"updated_at":"2026-11-02T13:42:15.603999Z"}],"euvd":[{"id":"EUVD-2026-44838","description":"A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources—such as memory, CPU, and file descriptors—leading to a complete denial of service for legitimate users.","status":"published","published":"2026-07-16T00:10:50Z","modified":"2026-07-16T13:58:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:51.881225Z"}],"ghsa":[{"id":"GHSA-gmv6-fcfc-3372","title":"A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows...","description":"A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources—such as memory, CPU, and file descriptors—leading to a complete denial of service for legitimate users.","status":"published","published":"2026-07-16T03:32:44Z","modified":"2026-07-16T12:33:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:09:33.90316Z"}],"nvd":[{"id":"CVE-2026-23538","description":"A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources—such as memory, CPU, and file descriptors—leading to a complete denial of service for legitimate users.","status":"published","published":"2026-07-16T01:16:30.53Z","modified":"2026-07-16T14:16:49.493Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:30.250437Z"}]}}