VYPR
← All advisories
High severityNVD Advisory· Published Jun 10, 2026· Updated Jun 10, 2026

Acknowledgement extension out of memory

CVE-2025-53114

Description

Impact

Bad clients that always send a fixed batch value while the server is using the acknowledgement extension can cause the unacknowledged message queue to grow indefinitely, eventually resulting in an OutOfMemoryError.

Such bad clients would always send:

{
  "channel": "/meta/connect",
  ...
  "ext": { "ack": 1 }
}

The server would never clear the unacknowledged message queue, and one bad client can cause a server outage.

### Patches 5.0.x - https://github.com/cometd/cometd/pull/2168 6.0.x - https://github.com/cometd/cometd/pull/2169 8.0.x - https://github.com/cometd/cometd/pull/2118

Workarounds

Disable the acknowledgement extension.

### Resources https://github.com/cometd/cometd/discussions/2116 https://github.com/cometd/cometd/issues/2117

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.cometd.java:cometd-java-server-commonMaven
>= 5.0.0, < 5.0.235.0.23
org.cometd.java:cometd-java-server-commonMaven
>= 6.0.0, < 6.0.196.0.19
org.cometd.java:cometd-java-server-commonMaven
>= 7.0.0, < 7.0.197.0.19
org.cometd.java:cometd-java-server-commonMaven
>= 8.0.0, < 8.0.98.0.9

Affected products

1
  • CometD/CometDllm-fuzzy
    Range: before 5.0.x, before 6.0.x, before 8.0.x

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.