CVE-2026-93558 in AMQ Broker
Summary
by MITRE • 09/18/2026
Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified as Unbounded Per-Connection Queue Growth in the WebSocketServerExtensionHandler represents a critical resource exhaustion flaw within network communication libraries, specifically affecting implementations that handle WebSocket protocol extensions. This issue stems from an architectural oversight where the server-side handler fails to implement effective backpressure mechanisms or size limits for internal queues associated with individual client connections. When a remote attacker initiates a connection and subsequently engages in high-frequency message transmission or sends malformed extension frames, the server allocates memory buffers to process these inputs without verifying if the queue has reached a safe operational threshold. Because there is no upper bound on the number of items that can be queued per active session, an adversary can systematically fill this unbounded data structure by maintaining persistent connections and continuously sending small but numerous packets or triggering extension processing routines that require queuing for asynchronous handling.
From a technical perspective, this flaw aligns with CWE-400, which classifies issues related to Uncontrolled Resource Consumption. The specific mechanism involves the WebSocketServerExtensionHandler component, which is responsible for negotiating and managing extensions such as compression (e.g., permessage-deflate) or custom protocol layers. When these handlers process incoming data, they often place tasks or parsed frames into a queue for subsequent processing by worker threads. Without strict limits on the depth of this queue, memory allocation continues indefinitely as long as new messages arrive faster than they are consumed. This creates a classic denial-of-service scenario where the application server's heap space is gradually depleted. As memory usage climbs, the Java Virtual Machine or underlying runtime environment may trigger garbage collection cycles more frequently, leading to significant latency spikes and eventual OutOfMemoryError exceptions that crash the process or force it into an unresponsive state.
The operational impact of this vulnerability is severe for any service relying on WebSocket connections for real-time communication, such as chat applications, financial trading platforms, gaming servers, or IoT management dashboards. An attacker does not require authentication to exploit this flaw; a simple TCP connection followed by sustained traffic generation is sufficient to trigger the resource exhaustion. This makes it particularly dangerous in public-facing services where automated scanning tools can easily identify vulnerable endpoints and launch distributed denial-of-service attacks with minimal effort. The resulting service disruption affects all users connected to the affected server, not just the attacker’s session, as shared resources like CPU cycles for garbage collection and overall memory availability are degraded across the entire application instance.
Mitigation strategies must focus on enforcing strict limits at both the protocol level and the application logic layer. Developers should configure maximum queue sizes within the WebSocketServerExtensionHandler or its underlying channel pipeline to ensure that if a client sends data faster than it can be processed, excess frames are dropped rather than queued indefinitely. Implementing backpressure mechanisms is essential; this involves signaling clients to slow down their transmission rate when internal buffers approach capacity thresholds. Additionally, setting strict timeouts for idle connections and monitoring memory usage patterns can help detect anomalous behavior early. Security teams should also consider deploying Web Application Firewalls that inspect WebSocket traffic for unusual volume or frequency anomalies, providing an additional layer of defense against resource exhaustion attacks while the underlying code is patched to enforce bounded queue sizes in accordance with secure coding standards.