What is the CVSS score of CVE-2026-23538?

CVE-2026-23538 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.7%.

Which versions of Feast Feature Server are affected by CVE-2026-23538?

Feast Feature Server and Red Hat OpenShift AI installations are vulnerable to remote denial-of-service attacks that exhaust system resources and lock out legitimate users.. A patch is available.

How to fix or mitigate CVE-2026-23538?

Within 24 hours: Inventory all Feast Feature Server instances and Red Hat OpenShift AI deployments; identify which are Internet-facing or accessible from untrusted networks; monitor system resource utilization (memory, CPU, file descriptors) for anomalies. Within 7 days: Implement network-level connection limits and rate limiting on the /ws/chat WebSocket endpoint using a reverse proxy or WAF; restrict access to the endpoint via firewall rules to only trusted internal clients; configure per-connection and per-user resource quotas. Within 30 days: Monitor upstream Feast and Red Hat repositories for patched versions (target versions containing fixes for connection caps, message size limits, and rate limiting); apply vendor patches immediately upon release or consider upgrading to RHOAI versions that include the fix.

Feast Feature Server CVE-2026-23538

EUVD-2026-44838 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-16 redhat

GHSA-gmv6-fcfc-3372

Denial Of Service Red Hat Openshift Ai Rhoai Feast Feast Feature Server Red Hat

7.5

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable /ws/chat with no auth or interaction and low complexity gives AV:N/AC:L/PR:N/UI:N; resource exhaustion is availability-only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 16, 2026 - 02:02 EUVD

Source Code Evidence Fetched

Jul 16, 2026 - 01:13 vuln.today

Analysis Generated

Jul 16, 2026 - 01:13 vuln.today

CVE Published

Jul 16, 2026 - 00:10 cve.org

HIGH 7.5

DescriptionCVE.org

A vulnerability was identified in the Feast Feature Server's /ws/chat endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources-such as memory, CPU, and file descriptors-leading to a complete denial of service for legitimate users.

AnalysisAI

Denial of service in the Feast Feature Server (the Python feature-store serving component, also shipped within Red Hat OpenShift AI/RHOAI) lets remote unauthenticated attackers exhaust host resources through its /ws/chat WebSocket endpoint. Because the endpoint accepts unlimited concurrent connections and unbounded message traffic, opening many simultaneous sockets drains memory, CPU, and file descriptors until legitimate clients are locked out. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; the upstream fix in PR #192 caps connections, message size, and message rate.

Technical ContextAI

Feast is an open-source feature store used in MLOps pipelines; its Feature Server (sdk/python/feast/feature_server.py) is a FastAPI/Starlette application that exposes an interactive /ws/chat WebSocket alongside REST endpoints. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the WebSocket handler tracked active connections in a manager but enforced no ceiling on connection count, per-message size, message rate, or read idle time. The CPE data covers cpe:2.3:a:feast:feast_feature_server and multiple cpe:2.3:a:red_hat:red_hat_openshift_ai_(rhoai) entries, confirming the flaw reaches consumers both as the standalone project and as a component bundled inside Red Hat OpenShift AI. The corrective PR introduces MAX_WS_CONNECTIONS=5, MAX_MESSAGE_SIZE=4096, MAX_MESSAGES_PER_MINUTE=60, and a 60-second read timeout, and separately adds inject_user_details authentication dependencies to the /read-document and /save-document endpoints.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change from https://github.com/red-hat-data-services/feast/pull/192, which enforces a maximum of 5 concurrent WebSocket connections, a 4096-byte message-size cap, a 60-messages-per-minute rate limit, and a 60-second read timeout, and additionally requires authentication (inject_user_details) on /read-document and /save-document. Track the official RHOAI update via the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-23538 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2429311, and upgrade to the vendor-published fixed build once available. As compensating controls until patched: place the Feature Server behind an authenticating reverse proxy or API gateway and require auth before the /ws/chat upgrade (trade-off: breaks any anonymous chat clients); enforce per-source-IP connection and rate limits at the ingress/load balancer (trade-off: shared-egress or NAT'd legitimate users may be throttled); restrict network exposure of the Feature Server to trusted subnets or an internal service mesh (trade-off: blocks intended external consumers); and set OS-level file-descriptor/ulimit and container memory limits so a socket flood degrades one pod rather than the node (trade-off: the targeted pod still becomes unavailable).