dev.vertique:vertique-cache-redis (>=0.2.0, <=0.3.0), dev.vertique:vertique-rate-limit-redis (>=0.2.0, <=0.3.0) +27 more potentially affected by CVE-2026-102465 via io.vertx:vertx-redis-client (>=5.1.0, <=5.1.9)

io.vertx:vertx-redis-client MAVEN version =5.1.0, =0.2.0, =0.2.0, =0.2.0, =0.1.0, =0.1.0, =0.3.0 - io.quarkus:quarkus-oidc-redis-token-state-manager 4.0.0.beta1 - io.quarkus:quarkus-oidc-redis-token-state-manager-deployment 4.0.0.beta1 - io.quarkus:quarkus-redis-cache 4.0.0.beta1 -...

CVE-2026-108748

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

EUVD-2026-96913

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108748

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108748

Quarkus LangChain4j versions 1.9.0 through 1.14.1 are vulnerable to a memory exhaustion issue within the chat-scopes WebSocket /_chat/routes endpoint. The root cause is a missing release of memory where unauthenticated remote clients can send repeated CONNECT frames while reusing a single chatId ...

CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

PT-2026-110150

🚨 CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket / chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId,...

CVE-2026-108748: Missing Release of Memory after Effective Lifetime

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

Quarkiverse Hub Quarkus LangChain4j Resource Management Error Vulnerability

The Quarkiverse Hub for Quarkus LangChain4j versions 1.9.0 to 1.14.1 has a resource management vulnerability. This vulnerability stems from a memory release deficiency in the chat-scopes WebSocket /chat/routes endpoint. Attackers send repeated CONNECT frames using the same chatId, causing isolate...

io.quarkiverse.langchain4j:quarkus-langchain4j-chatbot (>=1.5.0.cr1, <=1.8.4), io.quarkiverse.langchain4j:quarkus-langchain4j-chatbot-deployment (>=1.5.0.cr1, <=1.8.4) +5 more potentially affected by CVE-2026-87742 via io.quarkus:quarkus-websockets-next (>=3.27.0.cr1, <=3.27.5.2)

io.quarkus:quarkus-websockets-next MAVEN version =3.27.0.cr1, =1.5.0.cr1, =1.5.0.cr1, =1.7.0, =1.7.0, =1.7.0, =3.27.0.cr1, =3.27.0.cr1, =3.27.5.2 Source cves: CVE-2026-87742 Source advisory: MEND:CVE-2026-87742...

io.kaoto.forage:forage-memory-infinispan (1.5.0), io.kaoto.forage:forage-memory-message-window (1.5.0) +5 more potentially affected by CVE-2026-49042 via org.apache.camel:camel-langchain4j-agent (>=4.19.0, <=4.20.0)

org.apache.camel:camel-langchain4j-agent MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49042 Source advisory: GHSA-HH8R-75R6-QRG9...

io.kaoto.forage:forage-memory-infinispan (1.5.0), io.kaoto.forage:forage-memory-message-window (1.5.0) +10 more potentially affected by CVE-2026-49042 via org.apache.camel:camel-langchain4j-tools (>=4.19.0, <=4.20.0)

org.apache.camel:camel-langchain4j-tools MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.19.0, =4.20.0 Source cves: CVE-2026-49042 Source advisory: OSV:GHSA-HH8R-75R6-QRG9...

io.quarkiverse.langchain4j:quarkus-langchain4j-docs (0.15.1), io.quarkiverse.langchain4j:quarkus-langchain4j-pgvector (0.15.1) +1 more potentially affected by CVE-2026-55405 via dev.langchain4j:langchain4j-pgvector (0.31.0)

dev.langchain4j:langchain4j-pgvector MAVEN version 0.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.langchain4j:langchain4j-pgvector and may be impacted: - io.quarkiverse.langchain4j:quarkus-langchain4j-docs 0.15.1 -...

io.quarkiverse.langchain4j:quarkus-langchain4j-docs (0.18.0.cr1), io.quarkiverse.langchain4j:quarkus-langchain4j-pgvector (>=0.18.0.cr1, <=0.19.0) +1 more potentially affected by CVE-2026-55405 via dev.langchain4j:langchain4j-pgvector (0.34.0)

dev.langchain4j:langchain4j-pgvector MAVEN version 0.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.langchain4j:langchain4j-pgvector and may be impacted: - io.quarkiverse.langchain4j:quarkus-langchain4j-docs 0.18.0.cr1 -...

io.quarkiverse.langchain4j:quarkus-langchain4j-docs (>=0.16.0, <=0.16.4), io.quarkiverse.langchain4j:quarkus-langchain4j-pgvector (>=0.16.0, <=0.16.4) +1 more potentially affected by CVE-2026-55405 via dev.langchain4j:langchain4j-pgvector (0.32.0)

dev.langchain4j:langchain4j-pgvector MAVEN version 0.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.langchain4j:langchain4j-pgvector and may be impacted: - io.quarkiverse.langchain4j:quarkus-langchain4j-docs =0.16.0, =0.16.0, =0.16.0, =0.16.4...

io.quarkiverse.langchain4j:quarkus-langchain4j-docs (>=0.17.0.cr1, <=0.17.2), io.quarkiverse.langchain4j:quarkus-langchain4j-pgvector (>=0.17.0.cr1, <=0.17.2) +1 more potentially affected by CVE-2026-55405 via dev.langchain4j:langchain4j-pgvector (0.33.0)

dev.langchain4j:langchain4j-pgvector MAVEN version 0.33.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.langchain4j:langchain4j-pgvector and may be impacted: - io.quarkiverse.langchain4j:quarkus-langchain4j-docs =0.17.0.cr1, =0.17.0.cr1,...

io.micronaut.langchain4j:micronaut-langchain4j-store-pgvector (0.0.1), io.quarkiverse.langchain4j:quarkus-langchain4j-pgvector (>=0.20.0.cr1, <=0.21.0) +1 more potentially affected by CVE-2026-55405 via dev.langchain4j:langchain4j-pgvector (0.35.0)

dev.langchain4j:langchain4j-pgvector MAVEN version 0.35.0 is affected by a known vulnerability. The following packages have a transitive dependency on dev.langchain4j:langchain4j-pgvector and may be impacted: - io.micronaut.langchain4j:micronaut-langchain4j-store-pgvector 0.0.1 -...

io.quarkiverse.langchain4j:quarkus-langchain4j-pgvector (>=0.22.0.cr1, <=0.23.0.cr1), io.quarkiverse.langchain4j:quarkus-langchain4j-pgvector-deployment (>=0.22.0.cr1, <=0.23.0.cr1) potentially affected by CVE-2026-55405 via dev.langchain4j:langchain4j-pgvector (0.36.2)

dev.langchain4j:langchain4j-pgvector MAVEN version 0.36.2 is affected by a known vulnerability. The following packages have a transitive dependency on dev.langchain4j:langchain4j-pgvector and may be impacted: - io.quarkiverse.langchain4j:quarkus-langchain4j-pgvector =0.22.0.cr1, =0.22.0.cr1,...