{"data":{"id":"9bd455ef-8773-4f9c-9522-5a69d9ac36db","title":"CVE-2026-108748: Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes…","summary":"Quarkus LangChain4j versions 1.9.0 through 1.14.1 contain a missing-release-of-memory flaw in the chat-scopes WebSocket /_chat/routes endpoint. Unauthenticated remote clients can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108748","publishedAt":"2026-10-11T13:17:19.523Z","cveId":"CVE-2026-108748","cweIds":["CWE-401"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Quarkus LangChain4j"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Quarkus LangChain4j memory exhaustion in chat-scopes WebSocket","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-11T14:10:18.342Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-11T14:10:21.290Z","patchAvailable":null,"disclosureDate":"2026-10-11T13:17:19.523Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}