The Feast Feature Server exposes a vulnerability at its /ws/chat WebSocket endpoint that permits remote attackers to establish unlimited persistent connections without authentication. This lack of resource limits or throttling can exhaust server resources such as memory, CPU, and file descriptors, resulting in a denial of service condition. The CVSS 3.1 vector indicates the attack requires no privileges or user interaction and impacts availability only. No vendor-provided patch or remediation level is currently documented in the advisory from Red Hat.

Successful exploitation allows attackers to cause a denial of service by exhausting server resources through numerous unauthenticated WebSocket connections. This impacts the availability of the Feast Feature Server for legitimate users. There is no indication of confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation is documented, users should monitor the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-23538 for updates. Until a fix is available, consider implementing external rate limiting or connection throttling at network or proxy layers to mitigate resource exhaustion risks.