CVE-2026-90584
TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 13, 2026
- Updated
- Sep 14, 2026
- Reserved
- Sep 12, 2026
Description
A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Java-WebSocketTooTallNate |
|
References
- VDB-403169 | TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resourcesvdb-entrytechnical-description
- VDB-403169 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-90584 | CVE Analysis and Reportthird-party-advisory
- Submit #913786 | TooTallNate Java-WebSocket 1.6.0 Allocation of Resources Without Limits or Throttlingthird-party-advisory
- https://github.com/TooTallNate/Java-WebSocket/issues/1508exploitissue-tracking
- https://github.com/TooTallNate/Java-WebSocket/pull/1509issue-trackingpatch
- https://github.com/TooTallNate/Java-WebSocket/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.