CVE-2025-53114
CometD has acknowledgement extension out of memory
CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8.0.8, bad clients that always send a fixed batch value when the server is using the acknowledgement extension may cause the unacknowledged message queue to grow indefinitely, eventually causing an OutOfMemoryError. Versions 5.0.23, 6.0.19, 7.0.19, and 8.0.9 patch the issue. As a workaround, disable the acknowledgement extension.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
CometD has acknowledgement extension out of memory
CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8.0.8, bad clients that always send a fixed batch value when the server is using the acknowledgement extension may cause the unacknowledged message queue to grow indefinitely, eventually causing an OutOfMemoryError. Versions 5.0.23, 6.0.19, 7.0.19, and 8.0.9 patch the issue. As a workaround, disable the acknowledgement extension.
- Record
CVE-2025-53114- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2025-210284
CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8.0.8, bad clients that always send a fixed batch value when the server is using the acknowledgement extension may cause the unacknowledged message queue to grow indefinitely, eventually causing an OutOfMemoryError. Versions 5.0.23, 6.0.19, 7.0.19, and 8.0.9 patch the issue. As a workaround, disable the acknowledgement extension.
- Record
EUVD-2025-210284- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cqgj-h8vf-4w59
Acknowledgement extension out of memory
Impact
Bad clients that always send a fixed batch value while the server is using the acknowledgement extension can cause the unacknowledged message queue to grow indefinitely, eventually resulting in an OutOfMemoryError.
Such bad clients would always send:
{
"channel": "/meta/connect",
...
"ext": { "ack": 1 }
}
The server would never clear the unacknowledged message queue, and one bad client can cause a server outage.
Patches
5.0.x - https://github.com/cometd/cometd/pull/2168 6.0.x - https://github.com/cometd/cometd/pull/2169 8.0.x - https://github.com/cometd/cometd/pull/2118
Workarounds
Disable the acknowledgement extension.
Resources
https://github.com/cometd/cometd/discussions/2116 https://github.com/cometd/cometd/issues/2117
- Record
GHSA-cqgj-h8vf-4w59- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8.0.8, bad clients that always send a fixed batch value when the server is using the acknowledgement extension may cause the unacknowledged message queue to grow indefinitely, eventually causing an OutOfMemoryError. Versions 5.0.23, 6.0.19, 7.0.19, and 8.0.9 patch the issue. As a workaround, disable the acknowledgement extension.
- Record
CVE-2025-53114- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
CometD has acknowledgement extension out of memory
CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8.0.8, bad clients that always send a fixed batch value when the server is using the acknowledgement extension may cause the unacknowledged message queue to grow indefinitely, eventually causing an OutOfMemoryError. Versions 5.0.23, 6.0.19, 7.0.19, and 8.0.9 patch the issue. As a workaround, disable the acknowledgement extension.
- Record
CVE-2025-53114- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-cqgj-h8vf-4w59
Acknowledgement extension out of memory
Impact
Bad clients that always send a fixed batch value while the server is using the acknowledgement extension can cause the unacknowledged message queue to grow indefinitely, eventually resulting in an OutOfMemoryError.
Such bad clients would always send:
{
"channel": "/meta/connect",
...
"ext": { "ack": 1 }
}
The server would never clear the unacknowledged message queue, and one bad client can cause a server outage.
Patches
5.0.x - https://github.com/cometd/cometd/pull/2168 6.0.x - https://github.com/cometd/cometd/pull/2169 8.0.x - https://github.com/cometd/cometd/pull/2118
Workarounds
Disable the acknowledgement extension.
Resources
https://github.com/cometd/cometd/discussions/2116 https://github.com/cometd/cometd/issues/2117
- Record
GHSA-cqgj-h8vf-4w59- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.cometd.java:cometd-java-server-commonMaven |
5.0.0 to 5.0.22 | 5.0.23 |
org.cometd.java:cometd-java-server-commonMaven |
6.0.0 to 6.0.18 | 6.0.19 |
org.cometd.java:cometd-java-server-commonMaven |
7.0.0 to 7.0.18 | 7.0.19 |
org.cometd.java:cometd-java-server-commonMaven |
8.0.0 to 8.0.8 | 8.0.9 |
org.cometd.java:cometd-java-server-commonMaven |
5.0.0 up to 5.0.23, plus listed versions 5.0.15.0.105.0.115.0.125.0.13 Show 17 moreShow less5.0.145.0.155.0.165.0.175.0.185.0.195.0.25.0.205.0.215.0.225.0.35.0.45.0.55.0.65.0.75.0.85.0.9 |
5.0.23 |
org.cometd.java:cometd-java-server-commonMaven |
6.0.0 up to 6.0.19, plus listed versions 6.0.16.0.106.0.116.0.126.0.13 Show 13 moreShow less6.0.146.0.156.0.166.0.176.0.186.0.26.0.36.0.46.0.56.0.66.0.76.0.86.0.9 |
6.0.19 |
org.cometd.java:cometd-java-server-commonMaven |
7.0.0 up to 7.0.19, plus listed versions 7.0.17.0.107.0.117.0.127.0.13 Show 13 moreShow less7.0.147.0.157.0.167.0.177.0.187.0.27.0.37.0.47.0.57.0.67.0.77.0.87.0.9 |
7.0.19 |
org.cometd.java:cometd-java-server-commonMaven |
8.0.0 up to 8.0.9, plus listed versions 8.0.18.0.28.0.38.0.48.0.58.0.68.0.78.0.8 |
8.0.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-53114 is a high vulnerability (CVSS 7.5) in Cometd, published June 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in org.cometd.java:cometd-java-server-common 5.0.23.