Skip to content
fr Sign in
Not rated

CVE-2026-24656 Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter

Description

Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS. NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue. This issue affects Apache Karaf Decanter before 2.12.0. Users are recommended to upgrade to version 2.12.0, which fixes the issue.

Affected products and versions

Product Affected versions Fixed in
Apache Karaf 2.12 earliest → < 2.12.0 2.12.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Karaf

The 15 CVEs of Apache Karaf →
CVE-2026-92142 Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC)… Not rated CVE-2026-91085 Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files… Not rated CVE-2026-91048 The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg Not rated CVE-2026-91012 org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the… Not rated
Track this CVE