Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck
CVE-2026-108748Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket
Medium 5.3
In plain English
A medium-severity memory leak in quarkus-langchain4j from quarkiverse. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 69.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| quarkiverse | quarkus-langchain4j | 1.9.0 – through 1.14.1 |
Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://hackmd.io/@haind/quarkus-langchain4j-chatscope-orphan-leak third-party-advisory
- https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/websocket/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/websocket/internal/ChatRouteEndpoint.java#L122-L160 technical-description
- https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/core/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/internal/ChatScopeManagedContext.java#L297-L311 technical-description
- https://github.com/quarkiverse/quarkus-langchain4j product
- VulnCheck Advisory: Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket third-party-advisory