CVE-2026-108748: fallo de gravedad media en quarkiverse quarkus-langchain4j
Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.4%
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Productos afectados
quarkiverse · quarkus-langchain4jReferencias
https://github.com/quarkiverse/quarkus-langchain4jhttps://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/core/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/internal/ChatScopeManagedContext.java#L297-L311https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/websocket/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/websocket/internal/ChatRouteEndpoint.java#L122-L160https://hackmd.io/@haind/quarkus-langchain4j-chatscope-orphan-leakhttps://www.vulncheck.com/advisories/quarkus-langchain4j-1.9.0-through-1.14.1-memory-exhaustion-via-chat-routes-websocket