CVE-2025-53114: 
Java vulnerability analysis and mitigation

CVE-2025-53114 is an uncontrolled resource consumption vulnerability in CometD's acknowledgement extension that allows unauthenticated remote attackers to cause a server-side OutOfMemoryError, resulting in a denial of service. It affects the Maven package org.cometd.java:cometd-java-server-common across versions 5.0.0–5.0.22, 6.0.0–6.0.18, 7.0.0–7.0.18, and 8.0.0–8.0.8. The vulnerability was disclosed on June 10, 2026 via a GitHub Security Advisory and assigned CVE-2025-53114. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is CWE-400 (Uncontrolled Resource Consumption): the server-side acknowledgement extension does not properly validate or bound the unacknowledged message queue when a client repeatedly sends a fixed, stale ack batch value. A malicious or misbehaving client connects to a CometD server with the acknowledgement extension enabled and sends /meta/connect requests that always include "ext": {"ack": 1} — a fixed batch number that never advances. Because the server interprets this as the client never having acknowledged any messages, it continuously enqueues new messages without ever clearing the queue, leading to unbounded heap growth and ultimately a JVM OutOfMemoryError. No authentication or special privileges are required; any network-reachable client can trigger this condition (GitHub Advisory, GitHub Issue #2117).

Successful exploitation causes the CometD server JVM to exhaust heap memory and throw an OutOfMemoryError, crashing or severely degrading the server and denying service to all legitimate users. A single bad client is sufficient to trigger a full server outage, making this a high-availability risk for any application relying on CometD for real-time web messaging. There is no confidentiality or integrity impact — the vulnerability is purely a denial-of-service condition (GitHub Advisory).

1. Identify target: Locate a CometD server (versions 5.0.0–8.0.8) with the acknowledgement extension enabled, accessible over the network.
2. Establish a CometD session: Connect to the server using a standard CometD handshake to obtain a clientId.
3. Subscribe to a high-traffic channel: Subscribe to a channel that receives frequent server-side messages, ensuring the unacknowledged queue grows quickly.
4. Send fixed-ack /meta/connect requests: Repeatedly send /meta/connect messages with a permanently fixed ack value (e.g., "ext": {"ack": 1}), never incrementing it regardless of server responses.
5. Queue exhaustion: The server continuously appends new messages to the unacknowledged queue for this client without ever clearing it, causing heap memory to grow indefinitely.
6. Trigger OutOfMemoryError: After sufficient time and message volume, the JVM heap is exhausted, causing an OutOfMemoryError and server crash or severe degradation, denying service to all users (GitHub Advisory).

• Logs: JVM OutOfMemoryError or java.lang.OutOfMemoryError: Java heap space entries in the CometD server application log; repeated /meta/connect requests from the same client with identical ack values in access logs.
• Network: High-frequency /meta/connect POST requests from a single source IP with a static "ext": {"ack": 1} payload in the request body.
• Process: Rapidly increasing JVM heap usage visible in JVM monitoring tools (e.g., JConsole, VisualVM, Prometheus JMX exporter); garbage collection logs showing frequent full GC cycles with little memory reclaimed.
• Application Behavior: Server becoming unresponsive or crashing; legitimate clients experiencing connection timeouts or dropped sessions (GitHub Advisory).

Upgrade to the patched versions: 5.0.23, 6.0.19, 7.0.19, or 8.0.9, which address the issue by properly handling queue maxed events in the acknowledgement extension. For deployments that cannot upgrade immediately, the recommended workaround is to disable the acknowledgement extension on the server. Patches were backported to the 5.0.x and 6.0.x branches via PRs #2168 and #2169, and the original fix for 8.0.x was delivered in PR #2118 (GitHub Advisory, PR #2118, PR #2168, PR #2169).