Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-90584

CVE-2026-90584MEDIUM

TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   N   N   L    5.5   .0072   52.4     —

AFFECTED
  Product         Versions  Fixed
  Java-WebSocket  1.6.0 –   —

TIMELINE
  Sep 12  Reserved by VulDB
  Sep 13  Published (CNA: VulDB)
  Sep 14  EXPLOIT PUBLISHED — CVE-2026-90584 (TooTallNate Java-WebSocket). Public exploit reference added.

CWE-400, CWE-770 · CNA: VulDB · CVSS v4.0 · 7 references · NVD status: Deferred

Description

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
September 12, 2026	Reserved	Reserved by VulDB
September 13, 2026	Published	Published (CNA: VulDB)
September 14, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-90584 (TooTallNate Java-WebSocket). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
TooTallNate	Java-WebSocket	—	1.6.0	—

Weaknesses

CWE-400 · CWE-770

References (7)

Authoritative record: CVE-2026-90584 at cve.org

Vendors: tootallnate

Weaknesses: CWE-400 · CWE-770

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-90584 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.