Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cometd/cometd

              9.0.x @ d1ee6a1
            

Fixes

CVEs

HIGH

Peak severity

42.1%

Coverage

Highlights

Denial of Service: 33 prior fixes. Scrutinize any change in this area.

cometd-java-server: most-fixed (24 issues). Treat as high-risk during review.

16 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers can bypass security checks, impersonate users, or hijack active sessions. This occurs when server-side components fail to correlate transport connection cookies (like BAYEUX_SESSION) with the message's clientId, or reuse un-handshook session contexts across multi-message batches.

Denial of Service: Unbounded resource usage leads to JVM Heap Exhaustion (OOME) due to memory leaks. This is driven by failures to sweep inactive browser mappings, unbounded caching of ChannelId strings, and failing to drain message queues when WebSocket connections are abruptly disconnected or errors occur.

Auth Bypass: CometD Oort cluster instances are susceptible to unauthorized node connections, communication spoofing, and cluster structure modification (CVE-2022-24721). Weak identification based solely on node URLs and weak SHA-1 cryptographic digests allowed arbitrary nodes to participate in handshakes.