PT-2026-98873

🗓️ 25 Sep 2026 00:00:00Reported by Positive TechnologiesType

Remote deserialization in LangChain4j-agentic AgenticScopeSerializer.fromJson() function.

Reporter	Title	Published	Views	Family All 10
CVE	CVE-2026-97869	25 Sep 202615:15	–	cve
Cvelist	CVE-2026-97869 langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization	25 Sep 202615:15	–	cvelist
EUVD	EUVD-2026-87114	25 Sep 202615:15	–	euvd
Mend	CVE-2026-97869	25 Sep 202615:15	–	mend
NVD	CVE-2026-97869	25 Sep 202616:17	–	nvd
Rapid7 Vulnerability Database (full)	CVE-2026-97869: Deserialization of Untrusted Data	25 Sep 202600:00	–	rapid7
vulnersOsv	dev.langchain4j.cdi:langchain4j-cdi-a2a (>=1.2.0, <=1.3.4), dev.langchain4j:langchain4j-agentic-a2a (>=1.12.1-beta21, <=1.18.0-beta28) +32 more potentially affected by CVE-2026-97869 via dev.langchain4j:langchain4j-agentic (>=1.12.1-beta21, <=1.18.0-beta28)	25 Sep 202615:15	–	vulnersosv
vulnersOsv	dev.langchain4j:langchain4j-agentic-a2a (>=1.6.0-beta12, <=1.11.9-beta19), dev.langchain4j:langchain4j-agentic-patterns (>=1.9.0-beta16, <=1.11.9-beta19) +22 more potentially affected by CVE-2026-97869 via dev.langchain4j:langchain4j-agentic (>=1.6.0-beta12, <=1.11.9-beta19)	25 Sep 202615:15	–	vulnersosv
vulnersOsv	dev.langchain4j:langchain4j-agentic-a2a (>=1.4.1-beta10, <=1.5.2-beta11), io.quarkiverse.langchain4j:quarkus-langchain4j-agentic (>=1.2.0.cr2, <=1.2.6) +1 more potentially affected by CVE-2026-97869 via dev.langchain4j:langchain4j-agentic (>=1.4.1-beta10, <=1.5.2-beta11)	25 Sep 202615:15	–	vulnersosv
Vulnrichment	CVE-2026-97869 langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization	25 Sep 202615:15	–	vulnrichment

Source	Link
vuldb	www.vuldb.com/submit/911825
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-97869
vuldb	www.vuldb.com/cve/CVE-2026-97869
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97869.json
github	www.github.com/langchain4j/langchain4j/security/advisories/GHSA-gmwr-7wmf-mrjm
github	www.github.com/afish3201-debug/CVE/blob/main/Insecure%20Jackson%20Default%20Typing%20Leads%20to%20Arbitrary%20Class%20Instantiation%20in%20LangChain4j%20Agentic%20Module.md
osv	www.osv.dev/vulnerability/CVE-2026-97869
vuldb	www.vuldb.com/vuln/409886/cti
vuldb	www.vuldb.com/vuln/409886
t	www.t.me/cveNotify/325074

25 Sep 2026 00:00Current

5.3Medium risk

Vulners AI Score5.3

CVSS 24.3

CVSS 42.1

CVSS 3.14.1

CVSS 34.1

EPSS0.00375

SSVC

langchain4j LangChain4j-agentic deserialization AgenticScopeSerializer.fromJson()remote attack