CVE-2026-90584

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90584
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90584.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90584
Published
2026-09-13T20:15:07Z
Modified
2026-09-16T03:30:15Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources
Details

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90584.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.6.1"
                },
                {
                    "last_affected": "1.6.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/tootallnate/java-websocket

Affected ranges

Type
GIT
Repo
https://github.com/tootallnate/java-websocket
Events
Introduced
da3cf2a777aed862f2f5b5cf060cae7969958667
Last Affected
da3cf2a777aed862f2f5b5cf060cae7969958667
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.6.0"
        },
        {
            "last_affected": "1.6.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.6.0
v1.*
v1.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90584.json"