CVE-2026-90584

TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

Analysis

AI-generated

Technical impact

The flaw resides in the processFrameContinuousAndNonFin method of the Fragmentation Handler. By manipulating incoming frames, an attacker can trigger uncontrolled allocation of memory resources, leading to resource exhaustion or denial of service. The weakness aligns with CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits).

Affected Systems

The vulnerability affects the TooTallNate Java-WebSocket library, versions up to 1.6.1. This includes any application that incorporates the available.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, while the EPSS score is less than 1% and the issue is not listed in CISA’s KEV catalog. The attack can be performed remotely and a public exploit has been released, suggesting a tangible risk for exposed services that use the vulnerable library. Without an official patch the risk remains until the pull request is merged and a new release issued.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest released version of Java-WebSocket once the patch is merged, or switch to an alternative library that does not contain the vulnerable function.
  • If upgrading is not immediately possible, block or limit the use of fragmentation features in your WebSocket implementation, or isolate the service to mitigate resource allocation.
  • Apply network-level controls such as limiting concurrent WebSocket connections per user/IP to reduce the potential impact of resource exhaustion attacks.

Generated by OpenCVE AI on September 15, 2026 at 16:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Title TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources
First Time appeared Tootallnate
Tootallnate java-websocket
Weaknesses CWE-400
CWE-770
CPEs cpe:2.3:a:tootallnate:java-websocket:*:*:*:*:*:*:*:*
Vendors & Products Tootallnate
Tootallnate java-websocket
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 14, 2026, 5:00 PM
Reserved
Sep 12, 2026, 5:40 PM

View source JSON

Updated
Sep 14, 2026, 4:59 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 9:17 PM
Modified
Sep 14, 2026, 8:56 PM

View source JSON

No data.

Updated
Sep 17, 2026, 7:47 PM

JSON