Skip to content

Vendor

org.cometd.java vulnerabilities

2 published CVES affecting org.cometd.java, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
2
Medium
0
Low
0
Unscored
0
CISA KEV
0
Atom feed of org.cometd.java alerts

Products

Latest org.cometd.java CVEs

Newest publication first

  1. CVE-2025-53114 CometD has acknowledgement extension out of memory

    Published
    HighCVSS 7.5 EPSS 0.68%

    CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8.0.8, bad clients that always send a fixed batch value when the server is using the acknowledgement extension may cause th...

  2. CVE-2022-24721 Incorrect Authorization in org.cometd.oort

    Published
    HighCVSS 8.1 EPSS 1.1%

    CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.