Bug 2532936

Summary:	CVE-2026-90584 Java-WebSocket: Java-WebSocket: Denial of Service due to resource allocation in fragmentation handling [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Vladimir Vasilev <vvasilev>
Component:	Java-WebSocket	Assignee:	libreoffice-sig
Status:	ASSIGNED ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	hegjon, libreoffice-sig, mattia.verga
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["faaeb95d-4e16-47d1-8871-45f292b11d38"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2532762

Description Vladimir Vasilev 2026-09-14 07:25:01 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

Comment 1 Mattia Verga 2026-09-20 08:35:56 UTC

Unfortunately, upstream isn't much reactive. An upstream bug pointing to the CVE has been opened since August with no response.