Remote Resource Exhaustion in Java-WebSocket

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90584

Affected Vendors & Products

Vendor	Product	Version / Range
tootallnate	java-websocket	to 1.6.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is in TooTallNate Java-WebSocket up to version 1.6.1. It involves a function called processFrameContinuousAndNonFin in the Fragmentation Handler component. An attacker could exploit this to cause excessive resource allocation, potentially leading to system slowdowns or crashes. The exploit is publicly available and can be launched remotely.

Impact Analysis

If exploited, this vulnerability could cause denial-of-service conditions by consuming excessive system resources. This might lead to degraded performance or complete unavailability of services relying on the affected Java-WebSocket library.

Mitigation Strategies

Update the Java-WebSocket library to a version beyond 1.6.1 where the fix has been applied. Monitor network traffic for unusual fragmentation patterns or resource exhaustion attempts targeting the WebSocket component.

Hi! I’m here to help you understand CVE-2026-90584. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70