Log in Start free

Vulnerability · Published Jun 18, 2026 · Assigned by GitHub_M

CVE-2025-53114CometD has acknowledgement extension out of memory

High 7.5

In plain English

A high-severity uncontrolled resource consumption in cometd from cometd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 47.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8.0.8, bad clients that always send a fixed batch value when the server is using the acknowledgement extension may cause the unacknowledged message queue to grow indefinitely, eventually causing an `OutOfMemoryError`. Versions 5.0.23, 6.0.19, 7.0.19, and 8.0.9 patch the issue. As a workaround, disable the acknowledgement extension.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.cometd.java:cometd-java-server-common5.0.23GHSA-cqgj-h8vf-4w59
Mavenorg.cometd.java:cometd-java-server-common6.0.19GHSA-cqgj-h8vf-4w59
Mavenorg.cometd.java:cometd-java-server-common7.0.19GHSA-cqgj-h8vf-4w59
Mavenorg.cometd.java:cometd-java-server-common8.0.9GHSA-cqgj-h8vf-4w59

Affected products (as reported)

VendorProductVersions
cometd cometd >= 5.0.0, < 5.0.23>= 6.0.0, < 6.0.19>= 7.0.0, < 7.0.19>= 8.0.0, < 8.0.9

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References