CVE-2026-24656

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.

The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS.

NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue.

This issue affects Apache Karaf Decanter before 2.12.0.

Users are recommended to upgrade to version 2.12.0, which fixes the issue.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Karaf	< 2.12.0

References

https://lists.apache.org/thread/dc5wmdn6hyc992olntkl75kk04ndzx34Mailing List
http://www.openwall.com/lists/oss-security/2026/01/24/1Mailing List, Third Party Advisory

Timeline

Published: Jan 26, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-24667.1The DukaPress WordPress plugin through 3.2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Re CVE-2026-246608.1A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b. A specially crafted malici CVE-2026-246616.5Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated CVE-2026-246624.8Cross-site scripting vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a file cont CVE-2026-246639.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an unauthenticated attacker to achieve remote c CVE-2026-246645.3The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a username enumerati CVE-2026-246655.4The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a stored Cross-Site CVE-2026-246666.5The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a Cross-Site Request CVE-2026-246675.0The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidat CVE-2026-246686.5The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a broken access cont CVE-2026-246697.8The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, an insecure password CVE-2026-24678.1Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags. This issue affects