Threats affecting pkg:maven/io.github.langchain4j/langchain4j-agentic

CVE-2026-97869 is a deserialization vulnerability in the langchain4j library affecting specific beta versions. It impacts the AgenticScopeSerializer.fromJson function in the LangChain4j-agentic component. Exploitation requires that AgenticScope persistence is enabled (which is opt-in) and that an attacker already has write access to the persistent store. The vulnerability has a low severity score and a high attack complexity, making exploitation difficult. Fixed versions have been released shortly after the issue was reported privately.