Quarkus LangChain4j: unauthenticated CONNECT frames leak chat scopes until the JVM exits

Impact

An unauthenticated client that repeatedly sends CONNECT frames reusing a single chatId leaves orphaned scopes in the activeScopes map, which are never released for the lifetime of the JVM. The result is steadily growing heap on the serving process until it degrades or dies, with no user action required to trigger it. On a GPU node this matters more than the modest availability-only score suggests: the leaking process is the one holding the accelerator, so restarting it means the model weights are reloaded and the GPU sits idle through warm-up, and a process killed by the OOM killer can leave the device in a state that needs the pod rescheduled. Exposure depends on whether the chat-scopes WebSocket endpoint is reachable beyond the cluster.

Who can reach it

Anyone who can open a WebSocket to the /_chat/routes endpoint. No authentication is required, so the exposure is whatever network can reach the serving port - a tenant pod on the same cluster network, or the internet if the endpoint is published through an ingress.

What to do

Upgrade past the affected range (1.9.0 through 1.14.1); the record does not name a fixed version, so confirm it against the project advisory before scheduling. Until then, keep the chat-scopes WebSocket endpoint off any untrusted network and put authentication in front of it. Remediation is a redeploy and restart of the serving process - expect a model reload and a cold-start window per replica, so roll replicas rather than restarting them together. No node drain or reboot is involved.

References

Related entries

• Crawl4AI: robots.txt fetch bypasses egress controls, giving blind SSRF to metadata endpointsCVE-2026-109239 · Crawl4AI (RobotsParser.can_fetch in the Docker server)Medium
• Hugging Face Accelerate: unsanitized shard paths in a checkpoint index give arbitrary file read and hangsCVE-2026-69112 · Hugging Face Accelerate (load_checkpoint_in_model / load_checkpoint_and_dispatch weight_map handling)Medium
• llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
• llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium
• BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium
• vLLM: DeepStream backend misclassification skips pixel limits and lets unauthenticated video exhaust GPU decodeCVE-2026-78684 · vLLM (DeepStream GPU decode path, pixel-limit enforcement)Medium