7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53114

CVE-2025-53114: Acknowledgement extension out of memory

Impact

Bad clients that always send a fixed batch value while the server is using the acknowledgement extension can cause the unacknowledged message queue to grow indefinitely, eventually resulting in an OutOfMemoryError.

Such bad clients would always send:

{
  "channel": "/meta/connect",
  ...
  "ext": { "ack": 1 }
}

The server would never clear the unacknowledged message queue, and one bad client can cause a server outage.

Patches

5.0.x - https://github.com/cometd/cometd/pull/2168 6.0.x - https://github.com/cometd/cometd/pull/2169 8.0.x - https://github.com/cometd/cometd/pull/2118

Workarounds

Disable the acknowledgement extension.

Resources

https://github.com/cometd/cometd/discussions/2116 https://github.com/cometd/cometd/issues/2117

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53114

CVE-2025-53114:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.cometd.java:cometd-java-server-common	maven	>= 5.0.0, <= 5.0.22	5.0.23
org.cometd.java:cometd-java-server-common	maven	>= 6.0.0, <= 6.0.18	6.0.19
org.cometd.java:cometd-java-server-common	maven	>= 7.0.0, <= 7.0.18	7.0.19
org.cometd.java:cometd-java-server-common	maven	>= 8.0.0, <= 8.0.8	8.0.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the cometd-java-server-common package, specifically within the acknowledgement extension. A malicious client can cause the server's unacknowledged message queue to grow without bounds, leading to an OutOfMemoryError. This is achieved by the client not acknowledging received messages, or by repeatedly sending a low, fixed acknowledgement batch number.

The investigation of the provided patches, such as commit fd3621c901092cda90f2826c35eae3a6114df674, reveals that the core of the issue is in the AcknowledgedMessagesSessionExtension class. This class implements the ServerSession.QueueListener interface, and its queued(ServerSession sender, ServerMessage message) method is invoked whenever a message is added to the session's queue.

Prior to the patch, the queued method would add messages to its internal queue (_queue) without any validation of the queue's size. The patch introduces a size check within this method, adding a configurable maxQueueSize and a mechanism to notify listeners when this limit is exceeded. The absence of this check is the root cause of the vulnerability.

Therefore, the function org.cometd.server.ext.AcknowledgedMessagesSessionExtension.queued is the primary vulnerable function. During an attack, this function would be repeatedly called as messages are sent to the malicious client's session, and its execution would be a clear indicator in a runtime profile of the resource consumption leading to the server outage.

Vulnerable functions

org.cometd.server.ext.AcknowledgedMessagesSessionExtension.queued

cometd-java/cometd-java-server/cometd-java-server-common/src/main/java/org/cometd/server/ext/AcknowledgedMessagesSessionExtension.java

This method is a listener called when a message is enqueued to a server session. In vulnerable versions, it did not enforce a limit on the size of the unacknowledged message queue (`_queue`). A malicious client could prevent messages from being acknowledged and removed from this queue, causing it to grow indefinitely with each new message added via the `queued` method, ultimately leading to an OutOfMemoryError.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.