CVE-2026-108748
Description
A flaw was found in Quarkus LangChain4j. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) through server memory exhaustion. By sending repeated WebSocket connection requests that reuse a single chat identifier, orphaned session data accumulates in memory without being properly released, degrading application availability until the service restarts.
Statement
This vulnerability is rated as Moderate severity because, although exploitable by unauthenticated remote clients, it only results in degraded service availability without permitting arbitrary code execution or compromising confidential data. The issue is confined to applications that explicitly incorporate the optional Quarkus LangChain4j WebSocket chat-scopes extension and expose its endpoint. Deployments that do not utilize this specific extension or chat route feature are not impacted.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
