CVE-2026-108748CWE-401

CVE-2026-108748

Medium · published October 11, 2026

CVSS v3.1

5.3

EPSS

Percentile

21.7

In the wild

Unconfirmed

What it is

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0: 6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS: 0.00301 · 21.7th percentile
Weakness: CWE-401 · Missing Release of Memory after Effective Lifetime
Published: 2026-10-11T17:17Z

References (6)

https://github.com/quarkiverse/quarkus-langchain4j · [email protected]https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/core/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/internal/ChatScopeManagedContext.java#L297-L311 · [email protected]https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/websocket/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/websocket/internal/ChatRouteEndpoint.java#L122-L160 · [email protected]https://hackmd.io/@haind/quarkus-langchain4j-chatscope-orphan-leak · [email protected]https://www.vulncheck.com/advisories/quarkus-langchain4j-1.9.0-through-1.14.1-memory-exhaustion-via-chat-routes-websocket · [email protected]https://hackmd.io/@haind/quarkus-langchain4j-chatscope-orphan-leak · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

13 OCT 03:28Z
EPSS moved — → 0%
epss
11 OCT 12:19Z
Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket
cvelistv5
11 OCT 12:19Z
Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket
cvelistv5