CVE-2026-108748: WebSocket memory leak enables DoS

CISO Take

Quarkus LangChain4j versions 1.9.0 through 1.14.1 leak memory in the chat-scopes WebSocket endpoint (/_chat/routes): an unauthenticated client can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in memory until the JVM exits. The impact is availability only (CVSS 5.3, no confidentiality or integrity effect), and there is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so urgency is moderate. The attack is trivial to script, though, and any internet-exposed chatbot or agent service using the chat-scopes WebSocket module can be driven to out-of-memory with no credentials. Upgrade to a fixed release beyond 1.14.1 (confirm in the vendor advisory), and until then block or authenticate access to /_chat/routes and set memory and connection-rate limits.

Sources:NVDATLASvulncheck.comgithub.com/quarkiverse/quarkus-langchain4j

What is the risk?

Medium. Exploitation needs no authentication, no user interaction and low complexity over the network, but the effect is limited to availability (A:L). Risk rises for internet-facing chat or agent endpoints that run without a WAF, rate limiting or container memory limits, because gradual heap exhaustion can cause a full service outage. No active exploitation, public exploit code or EPSS data is available at publication, so likelihood is currently unknown and should be re-checked as scoring data arrives.

How does the attack unfold?

Initial Access

Attacker connects without authentication to the exposed /_chat/routes WebSocket endpoint.

AML.T0049

Exploitation

Attacker sends repeated CONNECT frames reusing one chatId, creating orphaned scopes in activeScopes that are never released.

Impact

Heap memory is exhausted, degrading or crashing the JVM and making the AI chat service unavailable.

AML.T0029

Initial Access

Attacker connects without authentication to the exposed /_chat/routes WebSocket endpoint.

AML.T0049

Exploitation

Attacker sends repeated CONNECT frames reusing one chatId, creating orphaned scopes in activeScopes that are never released.

Impact

Heap memory is exhausted, degrading or crashing the JVM and making the AI chat service unavailable.

AML.T0029

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 30% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

INone

ALow

What should I do?

1 step

1) Upgrade quarkus-langchain4j to a release later than 1.14.1 that fixes the scope cleanup (verify the fixed version in the project repository and the VulnCheck advisory). 2) If patching is delayed, disable the chat-scopes WebSocket module or block /_chat/routes at the reverse proxy, WAF or API gateway, or restrict it to authenticated or internal clients. 3) Apply per-IP connection and message rate limits on WebSocket upgrades. 4) Set JVM heap and container memory limits with automatic restart so a leak cannot affect neighbouring services. 5) Detect abuse by monitoring heap growth, GC pressure, the number of active chat scopes, and many CONNECT frames reusing the same chatId from a single source.

How is it classified?

DoSFrameworkAgentAML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and maintain system resilience

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-108748?

Quarkus LangChain4j versions 1.9.0 through 1.14.1 leak memory in the chat-scopes WebSocket endpoint (/_chat/routes): an unauthenticated client can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in memory until the JVM exits. The impact is availability only (CVSS 5.3, no confidentiality or integrity effect), and there is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so urgency is moderate. The attack is trivial to script, though, and any internet-exposed chatbot or agent service using the chat-scopes WebSocket module can be driven to out-of-memory with no credentials. Upgrade to a fixed release beyond 1.14.1 (confirm in the vendor advisory), and until then block or authenticate access to /_chat/routes and set memory and connection-rate limits.

Is CVE-2026-108748 actively exploited?

No confirmed active exploitation of CVE-2026-108748 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-108748?

1) Upgrade quarkus-langchain4j to a release later than 1.14.1 that fixes the scope cleanup (verify the fixed version in the project repository and the VulnCheck advisory). 2) If patching is delayed, disable the chat-scopes WebSocket module or block /_chat/routes at the reverse proxy, WAF or API gateway, or restrict it to authenticated or internal clients. 3) Apply per-IP connection and message rate limits on WebSocket upgrades. 4) Set JVM heap and container memory limits with automatic restart so a leak cannot affect neighbouring services. 5) Detect abuse by monitoring heap growth, GC pressure, the number of active chat scopes, and many CONNECT frames reusing the same chatId from a single source.

What systems are affected by CVE-2026-108748?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM application backends, Conversational AI / chatbot services, WebSocket-based chat endpoints.

What is the CVSS score for CVE-2026-108748?

CVE-2026-108748 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.37%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksLLM application backendsConversational AI / chatbot servicesWebSocket-based chat endpoints

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.

Exploitation Scenario

An attacker finds a public chatbot built on Quarkus LangChain4j with the chat-scopes WebSocket endpoint exposed. They open a connection to /_chat/routes and repeatedly send CONNECT frames that reuse a single chatId. Each frame leaves an orphaned scope in activeScopes that is never freed. A simple script over a few connections steadily exhausts the heap, slowing responses and finally crashing the JVM, so the AI assistant is unavailable until it is restarted. The attacker can repeat this at will.

Weaknesses (CWE)

CWE-401Missing Release of Memory after Effective LifetimePrimary CWE-401Missing Release of Memory after Effective Lifetime

CWE-401 — Missing Release of Memory after Effective Lifetime: The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

[Implementation] Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone. For example, glibc in Linux provides protection against free of invalid pointers. When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391]. To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
[Architecture and Design] Use an abstraction library to abstract away risky APIs. Not a complete solution.

Source: MITRE CWE corpus.