CVE-2026-108748

Name of the Vulnerable Software and Affected Versions Quarkus LangChain4j versions 1.9.0 through 1.14.1

Description A memory leak exists in the chat-scopes WebSocket endpoint '/ chat/routes'. Unauthenticated remote clients can exhaust server memory by sending repeated CONNECT frames while reusing a single chatId. This action leaves orphaned scopes within activeScopes that persist until the JVM exits, leading to degraded system availability.

Recommendations Update Quarkus LangChain4j to a version later than 1.14.1. Restrict access to the '/ chat/routes' endpoint to minimize the risk of exploitation.