CVE-2026-108748
Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.
| CWE | CWE-401 |
| Vendor | quarkiverse |
| Product | quarkus-langchain4j |
| Published | Oct 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for quarkiverse quarkus-langchain4j
Be the first to know when new medium vulnerabilities affecting quarkiverse quarkus-langchain4j are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
quarkiverse / quarkus-langchain4j
1.9.0 ≤ 1.14.1
References
hackmd.io: https://hackmd.io/@haind/quarkus-langchain4j-chatscope-orphan-leak github.com: https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/websocket/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/websocket/internal/ChatRouteEndpoint.java#L122-L160 github.com: https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/core/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/internal/ChatScopeManagedContext.java#L297-L311 github.com: https://github.com/quarkiverse/quarkus-langchain4j vulncheck.com: https://www.vulncheck.com/advisories/quarkus-langchain4j-1.9.0-through-1.14.1-memory-exhaustion-via-chat-routes-websocket
Credits
HaiND from the Post and Telecommunication Institute of Technology