CVE-2025-53114: CometD has acknowledgement extension out of memory
Impact Bad clients that always send a fixed batch value while the server is using the acknowledgement extension can cause the unacknowledged message queue to grow indefinitely, eventually resulting in an OutOfMemoryError.
Such bad clients would always send:
json { "channel": "/meta/connect", ... "ext": { "ack": 1 } }
The server would never clear the unacknowledged message queue, and one bad client can cause a server outage.
Patches 5.0.x - https://github.com/cometd/cometd/pull/2168 6.0.x - https://github.com/cometd/cometd/pull/2169 8.0.x - https://github.com/cometd/cometd/pull/2118
Workarounds Disable the acknowledgement extension.
Resources https://github.com/cometd/cometd/discussions/2116 https://github.com/cometd/cometd/issues/2117
Other sources
CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8.0.8, bad clients that always send a fixed batch value when the server is using the acknowledgement extension may cause the unacknowledged message queue to grow indefinitely, eventually causing an OutOfMemoryError. Versions 5.0.23, 6.0.19, 7.0.19, and 8.0.9 patch the issue. As a workaround, disable the acknowledgement extension.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.cometd.java:cometd-java-server-commonto a version that resolves this vulnerability.Fixed in 8.0.9 - Upgrade
Upgrade
maven/org.cometd.java:cometd-java-server-commonto a version that resolves this vulnerability.Fixed in 7.0.19 - Upgrade
Upgrade
maven/org.cometd.java:cometd-java-server-commonto a version that resolves this vulnerability.Fixed in 6.0.19 - Upgrade
Upgrade
maven/org.cometd.java:cometd-java-server-commonto a version that resolves this vulnerability.Fixed in 5.0.23 - Upgrade
Upgrade
cometdto a version that resolves this vulnerability.Fixed in 5.0.23 - Upgrade
Upgrade
cometdto a version that resolves this vulnerability.Fixed in 6.0.19 - Upgrade
Upgrade
cometdto a version that resolves this vulnerability.Fixed in 7.0.19 - Upgrade
Upgrade
cometdto a version that resolves this vulnerability.Fixed in 8.0.9 - Configuration
As a workaround for the unacknowledged message queue growing indefinitely, disable the acknowledgement extension.
CometD acknowledgement extension acknowledgement extension = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53114?
The severity of CVE-2025-53114 is rated as high, with a score of 7.5.
What is the impact of CVE-2025-53114?
CVE-2025-53114 can lead to an OutOfMemoryError due to clients sending fixed batch values causing the unacknowledged message queue to grow indefinitely.
How do I fix CVE-2025-53114?
To fix CVE-2025-53114, avoid allowing clients that do not properly handle message acknowledgements from connecting to the server.
Who is affected by CVE-2025-53114?
CVE-2025-53114 affects users of the CometD Java server who have clients that misbehave by sending fixed batch values.
When was CVE-2025-53114 published?
CVE-2025-53114 was published on June 10, 2026.