CVE-2026-49042

CVE-2026-49042 — camel-langchain4j-tools Prompt-Injection → Header-Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack| Hijacked sink| Demonstrated impact ---|---|---|---|--- Camel Spring Boot| camel-spring-boot/|...

CVE-2026-108748

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108748

Quarkus LangChain4j versions 1.9.0 through 1.14.1 are vulnerable to a memory exhaustion issue within the chat-scopes WebSocket /_chat/routes endpoint. The root cause is a missing release of memory where unauthenticated remote clients can send repeated CONNECT frames while reusing a single chatId ...

EUVD-2026-96913

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108748: Missing Release of Memory after Effective Lifetime

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

PT-2026-110150

🚨 CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket / chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId,...

CVE-2026-97869

A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote...

CVE-2026-97869 langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization

A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote...

CVE-2026-97869 langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization

A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote...

EUVD-2026-87114

A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote...

CVE-2026-97869

A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote...

CVE-2026-97869 langchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization

A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote...

dev.langchain4j:langchain4j-agentic-a2a (>=1.4.1-beta10, <=1.5.2-beta11), io.quarkiverse.langchain4j:quarkus-langchain4j-agentic (>=1.2.0.cr2, <=1.2.6) +1 more potentially affected by CVE-2026-97869 via dev.langchain4j:langchain4j-agentic (>=1.4.1-beta10, <=1.5.2-beta11)

dev.langchain4j:langchain4j-agentic MAVEN version =1.4.1-beta10, =1.4.1-beta10, =1.2.0.cr2, =1.2.0.cr2, =1.2.6 Source cves: CVE-2026-97869 Source advisory: MEND:CVE-2026-97869...

dev.langchain4j.cdi:langchain4j-cdi-a2a (>=1.2.0, <=1.3.4), dev.langchain4j:langchain4j-agentic-a2a (>=1.12.1-beta21, <=1.18.0-beta28) +32 more potentially affected by CVE-2026-97869 via dev.langchain4j:langchain4j-agentic (>=1.12.1-beta21, <=1.18.0-beta28)

dev.langchain4j:langchain4j-agentic MAVEN version =1.12.1-beta21, =1.2.0, =1.12.1-beta21, =1.12.1-beta21, =1.12.1-beta21, =1.2.19, =1.2.19, =1.4.0, =4.4.0-m3, =4.4.0-m3, =4.4.0-m3, =4.4.0-m3, =4.4.0-m3, =4.4.0-m3, =...

CVE-2026-97869

A deserialization vulnerability exists in langchain4j affecting versions up to 1.5.3-beta10, 1.11.10-beta18, and 1.18.1-beta27. The flaw is located in the AgenticScopeSerializer.fromJson function within the AgenticScopeJsonSerializationIT.java file of the LangChain4j-agentic component. Remote exp...

CVE-2026-97869: Deserialization of Untrusted Data

A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote...

PT-2026-98873

Name of the Vulnerable Software and Affected Versions langchain4j versions prior to 1.5.3-beta11 langchain4j versions prior to 1.11.10-beta19 langchain4j versions prior to 1.18.1-beta28 Description A flaw in the LangChain4j-agentic component allows for remote deserialization. The issue resides in...

io.quarkiverse.langchain4j:quarkus-langchain4j-chatbot (>=1.5.0.cr1, <=1.8.4), io.quarkiverse.langchain4j:quarkus-langchain4j-chatbot-deployment (>=1.5.0.cr1, <=1.8.4) +5 more potentially affected by CVE-2026-87742 via io.quarkus:quarkus-websockets-next (>=3.27.0.cr1, <=3.27.5.2)

io.quarkus:quarkus-websockets-next MAVEN version =3.27.0.cr1, =1.5.0.cr1, =1.5.0.cr1, =1.7.0, =1.7.0, =1.7.0, =3.27.0.cr1, =3.27.0.cr1, =3.27.5.2 Source cves: CVE-2026-87742 Source advisory: MEND:CVE-2026-87742...