Executive brief
CometD is a web messaging framework used to deliver real-time data to browsers and applications. A vulnerability in how the server handles message acknowledgments allows a malicious client to force the server to store an ever-growing queue of messages in its memory. This can lead to the server running out of memory and crashing, resulting in a complete denial of service for all users.
Technical details
A denial-of-service vulnerability exists in CometD's acknowledgement extension due to uncontrolled resource consumption. When the acknowledgement extension is enabled, a malicious or misconfigured client can send a fixed batch value continuously, preventing the server from clearing acknowledged messages from the session queue. This causes the 'org.cometd.server.ServerSessionImpl' objects to retain an unbounded number of 'ServerMessageImpl' instances. Over time, this heap exhaustion leads to a 'java.lang.OutOfMemoryError' and server termination. The issue is addressed by improving the acknowledgement extension to notify and handle queue events. Patches are available in versions 5.0.23, 6.0.19, 7.0.19, and 8.0.9.
Affected products
- CometD CometD 5.0.0 - 5.0.22, 6.0.0 - 6.0.18, 7.0.0 - 7.0.18, 8.0.0 - 8.0.8
Timeline
- 2025-06-25: other: Initial community discussion regarding heap exhaustion reported
- 2025-07-08: patched: Fix merged into 8.0.x branch
- 2025-08-19: patched: Fix backported to 5.0.x and 6.0.x branches
- 2026-06-18: advisory: CVE-2025-53114 published