Memory Exhaustion Vulnerability in Quarkus LangChain4j by Quarkiverse
CVE-2026-108748

6.9MEDIUM

Key Information:

Vendor

Quarkiverse

Status
Quarkus-langchain4j
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108748?

Quarkus LangChain4j versions 1.9.0 through 1.14.1 contain a vulnerability in the chat-scopes WebSocket endpoint that can be exploited by unauthenticated remote clients. Attackers may send repeated CONNECT frames while reusing a single chatId, resulting in orphaned memory scopes that consume server resources. This can lead to significant performance degradation and service unavailability, as memory gets exhausted and the Java Virtual Machine (JVM) may require a restart to recover.

Affected Version(s)

quarkus-langchain4j 1.9.0 <= 1.14.1

References

https://hackmd.io/@haind/quarkus-langchain4j-chatscope-or...
third-party-advisory
https://github.com/quarkiverse/quarkus-langchain4j/blob/6...
technical-description
https://github.com/quarkiverse/quarkus-langchain4j/blob/6...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.