{"id":"CVE-2026-108748","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-108748","generatedAt":"2026-10-28T00:59:18.238Z","title":"Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory.","description":"Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.","published":"2026-10-11T13:17:20.000Z","lastModified":"2026-10-16T17:25:58.000Z","status":"Awaiting Analysis","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":6.9,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-401"],"affected":[],"epss":{"score":0.00366,"percentile":0.30192,"date":"2026-10-26","history":[{"date":"2026-10-12","score":0.00301,"percentile":0.21086}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.37%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-11T13:17:20.000Z","detail":{"score":"6.9","severity":"MEDIUM","publishedAt":"2026-10-11T13:17:19.523Z"},"summary":"New CVE, medium severity (CVSS 6.9)."}],"references":[{"url":"https://github.com/quarkiverse/quarkus-langchain4j","source":"disclosure@vulncheck.com"},{"url":"https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/core/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/internal/ChatScopeManagedContext.java#L297-L311","source":"disclosure@vulncheck.com"},{"url":"https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/websocket/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/websocket/internal/ChatRouteEndpoint.java#L122-L160","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@haind/quarkus-langchain4j-chatscope-orphan-leak","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/quarkus-langchain4j-1.9.0-through-1.14.1-memory-exhaustion-via-chat-routes-websocket","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@haind/quarkus-langchain4j-chatscope-orphan-leak","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-108748","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}