Login Request a demo
Low severity · published Jan 26, 2026
CVE-2026-24656
Apache Karaf: Decanter log-socket collector has deserialization vulnerability
3.7
CVSS
0.7%
EPSS
No
On KEV
Description
Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS. NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue. This issue affects Apache Karaf Decanter before 2.12.0. Users are recommended to upgrade to version 2.12.0, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AK
Apache Karaf · Apache Software Foundation
before 2.12.0 · source: vendor
KD
Karaf Decanter · Apache
before 2.12.0 · source: NVD
Affected product
AK
Apache Karaf
Apache Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24656
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24656
Mailing List
https://lists.apache.org/thread/dc5wmdn6hyc992olntkl75kk04ndzx34
Mailing List
http://www.openwall.com/lists/oss-security/2026/01/24/1
More from Apache Karaf
9.8
CVE-2026-91048
Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create
9.8
CVE-2026-91012
Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
8.8
CVE-2026-92142
Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
8.8
CVE-2026-91006
Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
7.5
CVE-2026-92230
Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching