Vulnerabilities

TI-2026-70726 CVE-2026-108748 · GHSA-crp7-w5m5-rwj8

Quarkus LangChain4j Memory Exhaustion via /_chat/routes WebSocket

HIGH 70

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /_chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00366 Published 2026-10-11 No fix listed CWE-401

TI-2026-30637 CVE-2026-42333 · GHSA-fr8f-rwjx-f32v

Information disclosure in quarkiverse quarkus-openapi-generator

HIGH 67

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.004 Published 2026-05-09 Fixed in 2.11.1-lts, 2.16.0-lts +1 CWE-200

TI-2026-28994 CVE-2026-40180 · GHSA-jx2w-vp7f-456q

Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class

HIGH 73

Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00402 Published 2026-04-10 Fixed in 2.15.0-lts, 2.16.0 CWE-22

Vulnerabilities

Filters

Quarkus LangChain4j Memory Exhaustion via /_chat/routes WebSocket

Information disclosure in quarkiverse quarkus-openapi-generator

Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class