CVE-2026-108748: Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Quarkus LangChain4j versions 1.9.0 through 1.14.1 with the chat-scopes WebSocket /_chat/routes endpoint reachable by remote clients are exposed. The affected endpoint accepts unauthenticated connections.
What does an attacker need to do to trigger the issue?
An attacker only needs network access to the /_chat/routes WebSocket endpoint. They can repeatedly send CONNECT frames that reuse a single chatId, causing orphaned scopes to remain in activeScopes.
Is authentication required for exploitation?
No. The vulnerability can be exploited by unauthenticated remote clients, and it requires no user interaction.
What happens after exploitation, and does restarting help?
Orphaned scopes accumulate in memory and can degrade server availability through memory exhaustion. The scopes remain in activeScopes until the JVM exits, so restarting the JVM clears the accumulated orphaned scopes.