PT-2026-4647 · Apache · Apache Karaf+1

R00T4Dm · Publicado 2026-01-25 · Atualizado 2026-03-03 · CVE-2026-24656

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Apache Karaf Decanter versions prior to 2.12.0

Description The Decanter log socket collector in Apache Karaf has a deserialization issue. The collector operates on port 4560 without authentication. If the allowed classes property is exposed, its configuration can be bypassed, leading to potential denial-of-service (DoS) conditions due to untrusted data deserialization. The Decanter log socket collector is not installed by default, meaning users who have not installed it are not affected.

Recommendations Upgrade to version 2.12.0 or later.

Correção

DoS

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2026-24656

GHSA-JMW5-58C7-587H

Produtos afetados

Apache Karaf

Decanter

Referências · 14

• https://github.com/apache/karaf-decanter/issues/555 · Nota
• https://github.com/apache/karaf-decanter/commit/9d7058d37160a16aaad34b488170adf277351e8b · Nota
• https://github.com/apache/karaf-decanter · Nota
• http://openwall.com/lists/oss-security/2026/01/24/1 · Nota
• https://twitter.com/CVEnew/status/2015733316482445647 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-24656 · Nota de Segurança
• https://lists.apache.org/thread/dc5wmdn6hyc992olntkl75kk04ndzx34 · Aviso do Fabricante
• https://t.me/CVEtracker/43012 · Publicação no Telegram
• https://twitter.com/Karma_X_Inc/status/2015704285414081021 · Publicação no Twitter
• https://twitter.com/oss_security/status/2015268373236527595 · Publicação no Twitter
• https://t.me/pentestingnews/72601 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-jmw5-58c7-587h · Aviso do Fabricante
• https://twitter.com/Komodosec/status/2028909670178660584 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-24656 · Aviso do Fabricante