High

Acknowledgement extension out of memory

Disclosed: 10.06.2026
Updated: 11.10.2026 12:22

Impact

Bad clients that always send a fixed batch value while the server is using the acknowledgement extension can cause the unacknowledged message queue to grow indefinitely, eventually resulting in an OutOfMemoryError.

Such bad clients would always send:

{
  "channel": "/meta/connect",
  ...
  "ext": { "ack": 1 }
}

The server would never clear the unacknowledged message queue, and one bad client can cause a server outage.

Patches

5.0.x - https://github.com/cometd/cometd/pull/2168 6.0.x - https://github.com/cometd/cometd/pull/2169 8.0.x - https://github.com/cometd/cometd/pull/2118

Workarounds

Disable the acknowledgement extension.

Resources

https://github.com/cometd/cometd/discussions/2116 https://github.com/cometd/cometd/issues/2117

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	org.cometd.java:cometd-java-server-common	>= 5.0.0, < 5.0.23, >= 6.0.0, < 6.0.19, >= 7.0.0, < 7.0.19, >= 8.0.0, < 8.0.9	5.0.23, 6.0.19, 7.0.19, 8.0.9

References

CVSS score 7.5/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-400
Platform: Java / Kotlin (Maven)
Package: org.cometd.java:cometd-java-server-common
Disclosed: 10.06.2026
Updated: 11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-cqgj-h8vf-4w59 - CC BY 4.0

Vulnerability history: org.cometd.java:cometd-java-server-common

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

This is the only known vulnerability of this package.

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application