A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources.
The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
tootallnate:java-websocket
References 7
https://vuldb.com/vuln/403169
VDB-403169 | TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources
https://vuldb.com/vuln/403169/cti
VDB-403169 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/cve/CVE-2026-90584
CVE-2026-90584 | CVE Analysis and Report
https://vuldb.com/submit/913786
Submit #913786 | TooTallNate Java-WebSocket 1.6.0 Allocation of Resources Without Limits or Throttling
https://github.com/TooTallNate/Java-WebSocket/issues/1508
NVD
https://github.com/TooTallNate/Java-WebSocket/pull/1509
NVD
https://github.com/TooTallNate/Java-WebSocket/
NVD