EUVD-2026-96913
GHSA-crp7-w5m5-rwj8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed /_chat/routes WebSocket
-
DeliverySend CONNECT frames reusing one chatId
-
ExploitAllocate orphaned chat scopes in activeScopes
-
ExecutionRepeat to grow heap unbounded
-
ImpactExhaust JVM memory and degrade availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Exploitation requires that the target deploy the quarkus-langchain4j chat-scopes WebSocket runtime and expose its /_chat/routes endpoint to the attacker; the flaw is triggered by sending repeated WebSocket CONNECT frames that reuse a single chatId, which leaves orphaned scopes in the activeScopes map. No authentication, privileges, or user interaction are needed (PR:N/UI:N), so against a reachable, chat-scopes-enabled deployment this is unauthenticated remote. The principal limiting factor is deployment scope: applications that do not use the chat-scopes WebSocket feature, or that keep the endpoint behind authentication/network controls, are not exposed, and the impact is bounded to availability (slow memory growth until JVM exit) rather than data compromise. |
| Impact | This is a moderate-severity availability-only flaw, not a top-tier emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) is internally consistent with the description: a remote, unauthenticated, low-complexity attack with no confidentiality or integrity impact and only LOW availability impact (gradual memory exhaustion / degradation, not an immediate crash), yielding the 6.9 score. No EPSS score, no CISA KEV listing, and no weaponized exploit were provided, so there is no evidence of active exploitation - treat the 6.9 as an upper bound on practical urgency. One signal is mildly conflicting: a public technical write-up (hackmd) and vendor advisory (VulnCheck) describe the exact orphaned-scope mechanism and source lines, which lowers the bar to reproduce, yet no packaged exploit code is referenced. The realistic risk is confined to internet-exposed Quarkus services that actually enable the chat-scopes WebSocket extension - a narrow population - so this is a 'patch in normal cycle' DoS issue rather than a drop-everything priority. |
| Exploit ScenarioDerived | An attacker who can reach an exposed /_chat/routes WebSocket endpoint repeatedly opens connections sending CONNECT frames that reuse a single chatId, causing the server to allocate chat scopes that are never released from the activeScopes map. Over time the orphaned scopes accumulate until the JVM runs out of heap, degrading or denying service to legitimate users. No authentication or user interaction is required; the detailed public write-up makes reproduction straightforward even though no turnkey exploit tool is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Memory exhaustion in the Quarkus LangChain4j chat-scopes WebSocket runtime (versions 1.9.0 through 1.14.1) lets unauthenticated remote clients repeatedly send WebSocket CONNECT frames to the /_chat/routes endpoint while reusing a single chatId, leaving orphaned scopes in the activeScopes map so heap usage grows steadily until the JVM is restarted. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) the effect is availability-only - no confidentiality or integrity impact - and exploitation requires the chat-scopes WebSocket feature to be deployed and the endpoint reachable from the attacker; deployments that do not use this feature or that place /_chat/routes behind authentication or network controls are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the EPSS signal is not notable.
RemediationAI
No vendor-released patch was identified at the time of analysis, so the first step is to confirm the current fix state against the upstream repository (https://github.com/quarkiverse/quarkus-langchain4j) and the VulnCheck advisory, then upgrade to the first Quarkus LangChain4j release issued after 1.14.1 that corrects the scope leak - do not assume a fixed version exists until it is published. Because exploitation only requires reaching the chat-scopes WebSocket runtime, the strongest compensating control is to remove the chat-scopes WebSocket dependency from builds that do not need it, which eliminates /_chat/routes entirely (trade-off: the chat-scopes WebSocket feature becomes unavailable). If the feature is required, place /_chat/routes behind authentication and network controls - reverse-proxy ACLs, mTLS, or an allowlist of client networks - accepting that this reduces exposure but does not stop the leak from a permitted client; additionally, enforce server-side generation of unique chatIds and impose a hard cap or time-to-live eviction on the activeScopes map so orphaned entries are reclaimed (trade-off: eviction can terminate legitimate long-lived chat contexts). Constraining JVM/container heap with an explicit -Xmx and enforcing restart policies limits blast radius but only converts the leak into earlier restarts rather than preventing it, so it should be treated as a stopgap. For detection, monitor heap growth, connection churn, and repeated CONNECT frames carrying identical chatIds, and alert on abnormal WebSocket connect rates against /_chat/routes; the technical write-up at https://hackmd.io/@haind/quarkus-langchain4j-chatscope-orphan-leak and the code references at https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/websocket/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/websocket/internal/ChatRouteEndpoint.java#L122-L160 and https://github.com/quarkiverse/quarkus-langchain4j/blob/658ac8268e1a453a6a2066952d9495fb925479e3/chat-scopes/core/runtime/src/main/java/io/quarkiverse/langchain4j/chatscopes/internal/ChatScopeManagedContext.java#L297-L311 document the vulnerable path for verification and any local patch backport.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-401 'missing release of memory after effective lifetime' defect in the Quarkiverse Quarkus LangChain4j extension, an AI/LLM orchestration library that exposes chat-scopes management over a WebSocket route. Per the supplied CPE (cpe:2.3:a:quarkiverse:quarkus-langchain4j:*:*:*:*:*:*:*:*), the whole extension line from 1.9.0 through 1.14.1 is in scope, but the vulnerable code path is specifically the chat-scopes WebSocket runtime: the endpoint implementation in chat-scopes/websocket/runtime (ChatRouteEndpoint.java, referenced lines 122-160) handling CONNECT frames, together with the scope store in chat-scopes/core/runtime (ChatScopeManagedContext.java, lines 297-311). Chat scopes are managed lifecycle objects keyed by chatId and held in an activeScopes map; when a client connects with a chatId that is already present, a new scope/context is established without the previous entry being released or evicted. Because the stale scope retains its associated conversation/context state through a strong reference, the objects are never garbage-collected and the map grows monotonically with each crafted CONNECT until heap pressure or OutOfMemoryError degrades or kills the service; the orphaned scopes persist until JVM exit. The input tags label this 'Information Disclosure', but neither the CVSS 4.0 vector (VC:N/VI:N) nor the independent assessment (C:N/I:N/A:L) supports any data-exposure impact - the observable effect is denial/degradation of availability through resource exhaustion.
Know when Quarkus Langchain4J gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Remote unauthenticated WebSocket access with no interaction gives AV:N/AC:L/PR:N/UI:N; impact is gradual memory-leak degradation only, so C:N/I:N and A:L, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scopes in activeScopes until the JVM exits and degrading availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB