PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-108748 quarkiverse CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-11T12:19:49.295Z and has not been modified since then. The vulnerability affects Quarkus LangChain4j versions 1.9.0 through 1.14.1, allowing unauthenticated remote clients to exhaust server memory via the /_chat/routes WebSocket endpoint, potentially degrading availability. Defenders responsible for these deployments should assess exposure and prioritize verification and mitigation.

Vendor
quarkiverse
Product
quarkus-langchain4j
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-11
Original CVE updated
2026-10-11
Advisory published
2026-10-11
Advisory updated
2026-10-11

Who should care

Defenders responsible for Quarkus LangChain4j deployments, particularly those using versions 1.9.0 through 1.14.1, should assess exposure and prioritize verification and mitigation.

Why it matters

Defenders should care about CVE-2026-108748 because it allows unauthenticated remote clients to exhaust server memory in Quarkus LangChain4j versions 1.9.0 through 1.14.1, potentially degrading availability. Defenders responsible for these deployments should verify exposure, assess compensating controls, and prioritize remediation or patching.

  • Potential degradation of availability due to memory exhaustion
  • Need for verification of exposure and affected versions
  • Potential for compensating controls to mitigate attack
  • Priority for remediation or patching

Technical summary

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. This vulnerability can be exploited by sending repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits. The vulnerability has a CVSS score of 6.9 and a severity of MEDIUM. Defenders should prioritize verifying exposure of Quarkus LangChain4j versions 1.9.0 through 1.14.1 and assessing compensating controls.

Defensive priority

Defenders should prioritize verifying exposure of Quarkus LangChain4j versions 1.9.0 through 1.14.1 and assessing compensating controls.

Recommended defensive actions

  • Verify exposure of Quarkus LangChain4j versions 1.9.0 through 1.14.1 in your environment
  • Assess compensating controls to mitigate potential memory exhaustion attacks
  • Monitor for unusual WebSocket activity on the /_chat/routes endpoint
  • Review vendor guidance for patching or updating affected systems
  • Conduct an inventory of assets using Quarkus LangChain4j to identify potential vulnerabilities
  • Implement additional monitoring to detect potential exploitation attempts
  • Track and document remediation efforts for exposed systems

Evidence notes

The CVE record and source item provide details on a missing release of memory vulnerability in Quarkus LangChain4j 1.9.0 through 1.14.1, which allows unauthenticated remote clients to exhaust server memory via the /_chat/routes WebSocket endpoint.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-108748 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-108748

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-108748 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-108748

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/108xxx/CVE-2026-108748.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@haind/quarkus-langchain4j-chatscope-orphan-leak

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/websocket/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/websocket/internal/ChatRouteEndpoint.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/core/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/internal/ChatScopeManagedContext.java

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/quarkiverse/quarkus-langchain4j

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/quarkus-langchain4j-1.9.0-through-1.14.1-memory-exhaustion-via-chat-routes-websocket

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.