CVE-2026-108748

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-108748

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108748.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-108748

Published

2026-10-11T12:19:49Z

Modified

2026-10-15T02:30:43Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket

Details

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-401"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108748.json"
}

References

Affected packages

Git / github.com/quarkiverse/quarkus-langchain4j

Affected ranges

Type

GIT

Repo

https://github.com/quarkiverse/quarkus-langchain4j

Events

Introduced

f8e0cf8cd9e7184a9a0b9549c13d64b3f5f27867

Fixed

658ac8268e1a453a6a2066952d9495fb925479e3

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.9.0"
        },
        {
            "last_affected":  "1.14.1"
        },
        {
            "fixed":  "1.14.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

1.*

1.10.0

1.10.0.CR1

1.10.0.CR2

1.11.0

1.11.0.CR1

1.11.0.CR2

1.11.1

1.11.2

1.12.0

1.12.0.CR1

1.12.0.CR2

1.13.0

1.14.0

1.14.0.CR2

1.14.0.CR3

1.9.0

1.9.1

1.9.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108748.json"