Non notée
CVE-2026-24656 Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter
Description
Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS. NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue. This issue affects Apache Karaf Decanter before 2.12.0. Users are recommended to upgrade to version 2.12.0, which fixes the issue.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Karaf 2.12 | premières → < 2.12.0 | 2.12.0 |
Références
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Karaf
Les 15 CVE de Apache Karaf →
CVE-2026-92142
Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC)…
Non notée
CVE-2026-91085
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files…
Non notée
CVE-2026-91048
The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg
Non notée
CVE-2026-91012
org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the…
Non notée