Executive brief
Java-WebSocket is a WebSocket implementation used in Java applications for real-time bidirectional communication. A vulnerability in the fragmentation handler allows remote attackers to exhaust server resources, potentially causing denial of service and application unavailability.
Technical details
The vulnerability exists in the processFrameContinuousAndNonFin function within the Draft_6455.java fragmentation handler component. This is a resource exhaustion vulnerability (CWE-400) where improper handling of fragmented WebSocket frames can lead to unbounded resource allocation. The vulnerability is remotely exploitable without authentication requirements, allowing an attacker to send specially crafted fragmented frames to trigger excessive resource consumption. A public exploit has been disclosed, though the library maintainers have not yet merged the available pull request fix.
Affected products
- TooTallNate Java-WebSocket up to 1.6.1
Timeline
- 2026-09-13: disclosed