CVE-2026-23538
High
Description
A vulnerability was identified in the Feast Feature Server's `/ws/chat` endpoint that allows remote attackers to establish persistent WebSocket connections without any authentication. By opening a large number of simultaneous connections, an attacker can exhaust server resources—such as memory, CPU, and file descriptors—leading to a complete denial of service for legitimate users.
SeverityHigh
CVSS7.5
Exploit probability—
ProductFeast Feature Server
PublishedJul 16, 2026
First seenJul 16, 2026
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- Feast Feast Feature Server0.59.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Feast Feast Feature Server | v < 0.59.0 | 0.59.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.