Description

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-13T21:17:02.603Z",
  "pubdate": "2026-09-13T21:17:02.603Z",
  "executiveSummary": "A resource allocation vulnerability exists in the Java-WebSocket library, specifically within the fragmentation handling logic of Draft_6455.java.\nThis vulnerability allows a remote, unauthenticated attacker to trigger excessive memory or resource allocation through maliciously crafted WebSocket frames.\nThe flaw impacts TooTallNate Java-WebSocket versions up to and including 1.6.1.\nThe primary risk is a Denial of Service (DoS) condition, where the application may crash or become unresponsive due to resource exhaustion.\nExploitation is possible over a network without requiring authentication, making this a significant availability risk.\nPublicly available exploit code increases the likelihood of active exploitation, necessitating prompt remediation efforts as the community awaits an official pull request acceptance.",
  "technicalDetails": "The vulnerability resides in the processFrameContinuousAndNonFin function within Draft_6455.java, a component responsible for managing fragmented WebSocket frames.\nThe root cause of the vulnerability lies in the improper handling or validation of incoming continuous/non-final frames, which leads to the uncontrolled allocation of memory or resources.\nIn the WebSocket protocol defined by RFC 6455, data can be transmitted in fragments to avoid buffering large messages. The vulnerable function processFrameContinuousAndNonFin is tasked with reconstructing these fragments.\nAn attacker can exploit this by sending a series of continuous frames that force the library to allocate resources (such as byte buffers) without adequate size limitations or validation checks.\nThe attack flow proceeds as follows: 1) The attacker initiates a WebSocket connection to the targeted server. 2) The attacker transmits a sequence of fragmented frames that violate expected protocol behavior, specifically designed to trigger the vulnerable code path in the Fragmentation Handler. 3) Upon processing these frames, the function fails to enforce constraints on the cumulative size of the fragmented message or the state of the internal buffers. 4) The library proceeds to allocate memory or resources proportional to the attacker's controlled input, leading to heap exhaustion or excessive memory consumption.\nBecause the function does not appropriately validate the frame state before proceeding with allocation, an attacker can rapidly overwhelm the application's memory capacity.\nThis flaw can be exploited remotely by an unauthenticated attacker, requiring only basic network connectivity to the target WebSocket endpoint.\nThe post-exploitation impact is primarily a Denial of Service (DoS), characterized by process instability, service degradation, or a complete crash of the hosting Java virtual machine due to an OutOfMemoryError.\nThe vulnerability affects TooTallNate Java-WebSocket versions through 1.6.1, and while the exploit is publicly documented, no official patch has been merged into the main codebase at this time."
}