Quarkus Langchain4J
Monthly
Memory exhaustion in the Quarkus LangChain4j chat-scopes WebSocket runtime (versions 1.9.0 through 1.14.1) lets unauthenticated remote clients repeatedly send WebSocket CONNECT frames to the /_chat/routes endpoint while reusing a single chatId, leaving orphaned scopes in the activeScopes map so heap usage grows steadily until the JVM is restarted. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) the effect is availability-only - no confidentiality or integrity impact - and exploitation requires the chat-scopes WebSocket feature to be deployed and the endpoint reachable from the attacker; deployments that do not use this feature or that place /_chat/routes behind authentication or network controls are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the EPSS signal is not notable.
Memory exhaustion in the Quarkus LangChain4j chat-scopes WebSocket runtime (versions 1.9.0 through 1.14.1) lets unauthenticated remote clients repeatedly send WebSocket CONNECT frames to the /_chat/routes endpoint while reusing a single chatId, leaving orphaned scopes in the activeScopes map so heap usage grows steadily until the JVM is restarted. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) the effect is availability-only - no confidentiality or integrity impact - and exploitation requires the chat-scopes WebSocket feature to be deployed and the endpoint reachable from the attacker; deployments that do not use this feature or that place /_chat/routes behind authentication or network controls are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the EPSS signal is not notable.