CVE-2026-24656

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24656", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-01-23T17:55:14.286Z", "datePublished": "2026-01-26T09:41:24.356Z", "dateUpdated": "2026-01-26T18:35:51.514Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.karaf.decanter.collector:org.apache.karaf.decanter.collector.log.socket", "product": "Apache Karaf", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.12.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "2.12.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "r00t4dm"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.</p><br>The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed.<br>It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS.<br><br><br>NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue.<br><br><p>This issue affects Apache Karaf Decanter before 2.12.0.</p><p>Users are recommended to upgrade to version 2.12.0, which fixes the issue.</p>"}], "value": "Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.\n\n\nThe Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed.\nIt means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS.\n\n\nNB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue.\n\nThis issue affects Apache Karaf Decanter before 2.12.0.\n\nUsers are recommended to upgrade to version 2.12.0, which fixes the issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-01-26T09:41:24.356Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/dc5wmdn6hyc992olntkl75kk04ndzx34"}], "source": {"advisory": "https://karaf.apache.org/security/cve-2026-24656.txt", "defect": ["https://github.com/apache/karaf-decanter/issues/555"], "discovery": "EXTERNAL"}, "title": "Apache Karaf: Decanter log-socket collector has deserialization vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/01/24/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-26T10:09:04.018Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-26T18:35:47.421252Z", "id": "CVE-2026-24656", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T18:35:51.514Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/01/24/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-26T10:09:04.018Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-24656", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T18:35:47.421252Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-26T18:34:52.720Z"}}], "cna": {"title": "Apache Karaf: Decanter log-socket collector has deserialization vulnerability", "source": {"defect": ["https://github.com/apache/karaf-decanter/issues/555"], "advisory": "https://karaf.apache.org/security/cve-2026-24656.txt", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "r00t4dm"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Karaf", "versions": [{"status": "affected", "version": "0", "lessThan": "2.12.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.12.0", "versionType": "semver"}], "packageName": "org.apache.karaf.decanter.collector:org.apache.karaf.decanter.collector.log.socket", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/dc5wmdn6hyc992olntkl75kk04ndzx34", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.\n\n\nThe Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed.\nIt means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS.\n\n\nNB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue.\n\nThis issue affects Apache Karaf Decanter before 2.12.0.\n\nUsers are recommended to upgrade to version 2.12.0, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.</p><br>The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed.<br>It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS.<br><br><br>NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue.<br><br><p>This issue affects Apache Karaf Decanter before 2.12.0.</p><p>Users are recommended to upgrade to version 2.12.0, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-01-26T09:41:24.356Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24656", "state": "PUBLISHED", "dateUpdated": "2026-01-26T18:35:51.514Z", "dateReserved": "2026-01-23T17:55:14.286Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-01-26T09:41:24.356Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.karaf.decanter.collector:org.apache.karaf.decanter.collector.log.socket", "product": "Apache Karaf", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.12.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "2.12.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:karaf_decanter:*:*:*:*:*:*:*:*", "matchCriteriaId": "8AC91F7D-EA3C-4D8A-95D2-BCA9902B744C", "versionEndExcluding": "2.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.\n\n\nThe Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed.\nIt means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS.\n\n\nNB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue.\n\nThis issue affects Apache Karaf Decanter before 2.12.0.\n\nUsers are recommended to upgrade to version 2.12.0, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de deserializaci\u00f3n de datos no confiables en Apache Karaf Decanter.\n\nEl colector de socket de registro de Decanter expone el puerto 4560, sin autenticaci\u00f3n. Si el colector expone la propiedad de clases permitidas, esta configuraci\u00f3n puede ser eludida.\nEsto significa que el colector de socket de registro es vulnerable a la deserializaci\u00f3n de datos no confiables, lo que eventualmente causa DoS.\n\nNB: El colector de socket de registro de Decanter no est\u00e1 instalado por defecto. Los usuarios que no han instalado el socket de registro de Decanter no se ven afectados por este problema.\n\nEste problema afecta a Apache Karaf Decanter anterior a la versi\u00f3n 2.12.0.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.12.0, que corrige el problema."}], "id": "CVE-2026-24656", "lastModified": "2026-06-17T10:23:22.320", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24656", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-26T18:35:47.421252Z", "version": "2.0.3"}}]}, "published": "2026-01-26T10:16:09.597", "references": [{"source": "security@apache.org", "tags": ["Mailing List"], "url": "https://lists.apache.org/thread/dc5wmdn6hyc992olntkl75kk04ndzx34"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/01/24/1"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T02:41:55.305251+00:00", "value": {"mitigation_remediation": ["Upgrade Apache Karaf Decanter to version 2.12.0 or newer.", "Remove or disable the Decanter log socket collector if it is not required.", "Restrict network access to port 4560 using firewall rules or network segmentation."], "summary": {"action": "Upgrade", "impact": "Deserialization of Untrusted Data leading to Denial of Service"}, "threat_synthesis": {"affected_systems": "The issue affects Apache Karaf Decanter versions prior to 2.12.0. The log socket collector is not installed by default; therefore, only deployments that have installed Decanter and left the collector enabled are impacted. The unprotected port 4560 serves as the attack surface.", "description_and_impact": "The vulnerability stems from the Deserialization of Untrusted Data in the Decanter log socket collector of Apache Karaf. When an unauthenticated client connects to the exposed port 4560 and sends malicious payloads, the collector processes them without proper validation, potentially triggering DoS conditions. This weakness is classified as CWE\u2011502, encompassing insecure deserialization threats.", "risk_and_exploitability": "The CVSS score of 3.7 indicates a low overall severity, and the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not currently listed in the CISA KEV catalog. An attacker can exploit the flaw by sending crafted serialized objects to the collector; if the configuration exposes allowed classes, authentication bypass may occur, leading to service disruption."}}}}, "created": "2026-01-27T09:03:40.673150+00:00", "updated": "2026-04-18T02:45:27.285310+00:00", "vendors": ["apache", "apache$PRODUCT$karaf"]}