CVE-2026-24656: apache software foundation apache karaf Deserialization of Untrusted Data

Vulnerability summary

CVE-2026-24656 is a low (CVSS 3.7) Deserialization of Untrusted Data vulnerability in apache software foundation apache karaf. EPSS estimates a 0.73% chance of exploitation in the next 30 days, higher than 53.1% of scored vulnerabilities.

Timeline

1. 26-01-2026
   PublishedVulnerability first disclosed.
2. 26-01-2026
   Last modifiedVulnerability information updated.

Description

Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS. NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue. This issue affects Apache Karaf Decanter before 2.12.0. Users are recommended to upgrade to version 2.12.0, which fixes the issue.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.