CVE-2026-24656CWE-502

Apache Karaf: Decanter log-socket collector has deserialization vulnerability

Low · published January 26, 2026

CVSS v3.1
3.7
EPSS
1%
Percentile
51.9
In the wild
Unconfirmed
What it is

Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.

The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed.

It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS.

NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue.

This issue affects Apache Karaf Decanter before 2.12.0.

Users are recommended to upgrade to version 2.12.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00681 · 51.9th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-01-26T09:41Z
EPSS history
Timeline
  • 26 JAN 09:41Z
    Apache Karaf: Decanter log-socket collector has deserialization vulnerability
    cvelistv5