CVE-2025-53114

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-53114
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53114.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-53114
Aliases
Published
2026-06-18T16:25:47Z
Modified
2026-08-12T03:51:20Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
CometD has acknowledgement extension out of memory
Details

CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8.0.8, bad clients that always send a fixed batch value when the server is using the acknowledgement extension may cause the unacknowledged message queue to grow indefinitely, eventually causing an OutOfMemoryError. Versions 5.0.23, 6.0.19, 7.0.19, and 8.0.9 patch the issue. As a workaround, disable the acknowledgement extension.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53114.json"
}
References

Affected packages

Git / github.com/cometd/cometd

Affected ranges

Type
GIT
Repo
https://github.com/cometd/cometd
Events
Introduced
cf70b858ed344a941fac8fa8deb6def3327d464f
Fixed
baf656acc36fe00a0c1058ce28213272ac777549
Introduced
129e30f07db92e60fba1d330f08b9607156dcd60
Fixed
d8bef500d01b74b370cfc86e5b07d32ed2baf11e
Introduced
75c9c8e2d5c34c68df8484ad113beb1624bfe3f2
Fixed
52b8fca89b0515b14e421644f5acf92da978f002
Introduced
fe29bbede69bbe8c54c29ffc0a4c3c32ca1b9475
Fixed
7c79c83bc3e57d5f0b57e52b84ac9dcf3869a4aa
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.23"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.19"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.19"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.9"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

5.*
5.0.0
5.0.1
5.0.10
5.0.11
5.0.12
5.0.13
5.0.14
5.0.15
5.0.16
5.0.17
5.0.18
5.0.19
5.0.2
5.0.20
5.0.21
5.0.22
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
6.*
6.0.0
6.0.1
6.0.10
6.0.11
6.0.12
6.0.13
6.0.14
6.0.15
6.0.16
6.0.17
6.0.18
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
6.0.9
7.*
7.0.0
7.0.1
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.0.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53114.json"