CVE-2026-24656 json
Apache Karaf: Decanter log-socket collector has deserialization vulnerability
published 9mo ago modified 4mo ago also GHSA-jmw5-58c7-587h , EUVD-2026-4680
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.
The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS.
NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue.
This issue affects Apache Karaf Decanter before 2.12.0.
Users are recommended to upgrade to version 2.12.0, which fixes the issue.
Patch / fix
- maven org.apache.karaf.decanter.collector:org.apache.karaf.decanter.collector.log.socket 2.12.0
- Apache Software Foundation Apache Karaf 2.12.0
Is CVE-2026-24656 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 9mo ago
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.karaf.decanter.collector:org.apache.karaf.decanter.collector.log.socket | <2.12.0 |
2.12.0 |
Affected products
- Apache Software Foundation Apache Karaf
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/apache/karaf-decanter/commit/9d7058d37160a16aaad34b488170adf277351e8b
web
-
lists.apache.org
/thread/dc5wmdn6hyc992olntkl75kk04ndzx34
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2026/01/24/1
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-24656
advisory
-
github.com
/apache/karaf-decanter/issues/555
web
-
github.com
/apache/karaf-decanter
package
Sources
- CVE List CVE-2026-24656
- GitHub Advisory GHSA-jmw5-58c7-587h
- NVD CVE-2026-24656
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.