What is CVE-2026-24656?

CVE-2026-24656 is a low-severity vulnerability in Apache Karaf Decanter, classified under Deserialization of Untrusted Data. CVSS score: 3.7/10. Published 2026-01-26.

How severe is CVE-2026-24656?

Low severity. CVSS v3 base score is 3.7 out of 10.

Deserialization in Apache Karaf Decanter

CVE-2026-24656

Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS. NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue. This issue affects Apache Karaf Decanter before 2.12.0. Users are recommended to upgrade to version 2.12.0, which fixes the issue.

Vulnerability class: Insecure Deserialization

EPSS: 0.007 (47.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Apache Karaf_decanter
Apache Software Foundation Karaf — versions 0, 2.12.0

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

security@apache.org (vendor-advisory, Mailing List)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2026-24656?: CVE-2026-24656 is a low-severity vulnerability in Apache Karaf Decanter, classified under Deserialization of Untrusted Data. CVSS score: 3.7/10. Published 2026-01-26.
How severe is CVE-2026-24656?: Low severity. CVSS v3 base score is 3.7 out of 10.