{"id":"CVE-2025-53114","aliases":["GHSA-cqgj-h8vf-4w59"],"title":"Acknowledgement extension out of memory","summary":"Acknowledgement extension out of memory","severity":"high","cvss":7.5,"cwe":["CWE-400"],"vendor":"cometd","product":"org.cometd.java:cometd-java-server-common","ecosystem":"maven","affected":["org.cometd.java:cometd-java-server-common >= 5.0.0, <= 5.0.22","org.cometd.java:cometd-java-server-common >= 6.0.0, <= 6.0.18","org.cometd.java:cometd-java-server-common >= 7.0.0, <= 7.0.18","org.cometd.java:cometd-java-server-common >= 8.0.0, <= 8.0.8"],"patched":["org.cometd.java:cometd-java-server-common 5.0.23","org.cometd.java:cometd-java-server-common 6.0.19","org.cometd.java:cometd-java-server-common 7.0.19","org.cometd.java:cometd-java-server-common 8.0.9"],"published":"2026-06-10","updated":"2026-06-10","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-cqgj-h8vf-4w59","references":[{"url":"https://github.com/cometd/cometd/security/advisories/GHSA-cqgj-h8vf-4w59"},{"url":"https://github.com/cometd/cometd/issues/2117"},{"url":"https://github.com/cometd/cometd/pull/2118"},{"url":"https://github.com/cometd/cometd/pull/2168"},{"url":"https://github.com/cometd/cometd/pull/2169"},{"url":"https://github.com/cometd/cometd/discussions/2116"},{"url":"https://github.com/advisories/GHSA-cqgj-h8vf-4w59"}],"tags":["ghsa","maven"],"epss":0.00684,"epssPercentile":0.51181,"ingestedAt":"2026-07-07T15:41:59.561Z","slug":"CVE-2025-53114","body":"## Overview\n\n### Impact\nBad clients that always send a fixed batch value while the server is using the acknowledgement extension can cause the unacknowledged message queue to grow indefinitely, eventually resulting in an OutOfMemoryError.\n\nSuch bad clients would always send:\n\n```json\n{\n  \"channel\": \"/meta/connect\",\n  ...\n  \"ext\": { \"ack\": 1 }\n}\n```\n\nThe server would never clear the unacknowledged message queue, and one bad client can cause a server outage.\n\n### Patches\n5.0.x - https://github.com/cometd/cometd/pull/2168\n6.0.x - https://github.com/cometd/cometd/pull/2169\n8.0.x - https://github.com/cometd/cometd/pull/2118\n\n### Workarounds\nDisable the acknowledgement extension.\n\n### Resources\nhttps://github.com/cometd/cometd/discussions/2116\nhttps://github.com/cometd/cometd/issues/2117\n\n## Affected packages\n\n- `org.cometd.java:cometd-java-server-common >= 5.0.0, <= 5.0.22`\n- `org.cometd.java:cometd-java-server-common >= 6.0.0, <= 6.0.18`\n- `org.cometd.java:cometd-java-server-common >= 7.0.0, <= 7.0.18`\n- `org.cometd.java:cometd-java-server-common >= 8.0.0, <= 8.0.8`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.cometd.java:cometd-java-server-common 5.0.23`\n- `org.cometd.java:cometd-java-server-common 6.0.19`\n- `org.cometd.java:cometd-java-server-common 7.0.19`\n- `org.cometd.java:cometd-java-server-common 8.0.9`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}