---
id: CVE-2026-108748
title: >-
  Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory
  vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows
  unauthenticated remote clients to exhaust server memory
summary: >-
  Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory
  vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows
  unauthenticated remote clients to exhaust server memory. Attackers can send
  repea…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-401
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T13:17:19.523'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108748'
references:
  - url: 'https://github.com/quarkiverse/quarkus-langchain4j'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/core/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/internal/ChatScopeManagedContext.java#L297-L311
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/websocket/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/websocket/internal/ChatRouteEndpoint.java#L122-L160
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@haind/quarkus-langchain4j-chatscope-orphan-leak'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/quarkus-langchain4j-1.9.0-through-1.14.1-memory-exhaustion-via-chat-routes-websocket
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-11T13:51:17.037Z'
---

## Overview

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.