Description
A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Published: 2026-09-13
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Resource Exhaustion)
Action: Mitigate
AI Analysis

Impact

The flaw resides in the processFrameContinuousAndNonFin method of the Fragmentation Handler. By manipulating incoming frames, an attacker can trigger uncontrolled allocation of memory resources, leading to resource exhaustion or denial of service. The weakness aligns with CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits).

Affected Systems

The vulnerability affects the TooTallNate Java-WebSocket library, versions up to 1.6.1. This includes any application that incorporates the available.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, while the EPSS score is less than 1% and the issue is not listed in CISA’s KEV catalog. The attack can be performed remotely and a public exploit has been released, suggesting a tangible risk for exposed services that use the vulnerable library. Without an official patch the risk remains until the pull request is merged and a new release issued.

Generated by OpenCVE AI on September 15, 2026 at 16:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest released version of Java-WebSocket once the patch is merged, or switch to an alternative library that does not contain the vulnerable function.
  • If upgrading is not immediately possible, block or limit the use of fragmentation features in your WebSocket implementation, or isolate the service to mitigate resource allocation.
  • Apply network-level controls such as limiting concurrent WebSocket connections per user/IP to reduce the potential impact of resource exhaustion attacks.

Generated by OpenCVE AI on September 15, 2026 at 16:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 13 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Title TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources
First Time appeared Tootallnate
Tootallnate java-websocket
Weaknesses CWE-400
CWE-770
CPEs cpe:2.3:a:tootallnate:java-websocket:*:*:*:*:*:*:*:*
Vendors & Products Tootallnate
Tootallnate java-websocket
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Tootallnate Java-websocket
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-14T17:00:11.964Z

Reserved: 2026-09-12T17:40:21.667Z

Link: CVE-2026-90584

cve-icon Vulnrichment

Updated: 2026-09-14T16:59:59.934Z

cve-icon NVD

Status : Deferred

Published: 2026-09-13T21:17:02.603

Modified: 2026-09-14T20:56:48.220

Link: CVE-2026-90584

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T19:47:27Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling