PT-2026-4647 · Apache · Apache Karaf+1

R00T4Dm · Published 2026-01-25 · Updated 2026-03-03 · CVE-2026-24656

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Apache Karaf Decanter versions prior to 2.12.0

Description The Decanter log socket collector in Apache Karaf has a deserialization issue. The collector operates on port 4560 without authentication. If the allowed classes property is exposed, its configuration can be bypassed, leading to potential denial-of-service (DoS) conditions due to untrusted data deserialization. The Decanter log socket collector is not installed by default, meaning users who have not installed it are not affected.

Recommendations Upgrade to version 2.12.0 or later.

Fix

DoS

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-24656

GHSA-JMW5-58C7-587H

Affected Products

Apache Karaf

Decanter

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2026-24656 · Security Note
• https://lists.apache.org/thread/dc5wmdn6hyc992olntkl75kk04ndzx34 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jmw5-58c7-587h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24656 · Vendor Advisory
• https://github.com/apache/karaf-decanter/issues/555 · Note
• https://github.com/apache/karaf-decanter/commit/9d7058d37160a16aaad34b488170adf277351e8b · Note
• https://github.com/apache/karaf-decanter · Note
• http://openwall.com/lists/oss-security/2026/01/24/1 · Note
• https://twitter.com/CVEnew/status/2015733316482445647 · Twitter Post
• https://t.me/CVEtracker/43012 · Telegram Post
• https://twitter.com/Karma_X_Inc/status/2015704285414081021 · Twitter Post
• https://twitter.com/oss_security/status/2015268373236527595 · Twitter Post
• https://t.me/pentestingnews/72601 · Telegram Post
• https://twitter.com/Komodosec/status/2028909670178660584 · Twitter Post