CVE-2026-90584CWE-400CWE-770denial-of-service

CVE-2026-90584

Medium · published September 14, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
53.6
In the wild
Unconfirmed
What it is

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00724 · 53.6th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-14T01:17Z
References (7)
https://github.com/TooTallNate/Java-WebSocket/ · [email protected]https://github.com/TooTallNate/Java-WebSocket/issues/1508 · [email protected]https://github.com/TooTallNate/Java-WebSocket/pull/1509 · [email protected]https://vuldb.com/cve/CVE-2026-90584 · [email protected]https://vuldb.com/submit/913786 · [email protected]https://vuldb.com/vuln/403169 · [email protected]https://vuldb.com/vuln/403169/cti · [email protected]
EPSS history
Timeline
  • 15 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 13 SEP 20:15Z
    TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources
    cvelistv5