Baoquan Cui

**Name of the Vulnerable Software and Affected Versions** Apache Karaf (affected versions not specified) **Description** The `XmlUtils` component caches XML parser and transformer factories within static `ThreadLocal` fields on long-lived container threads. Since a `ThreadLocal` value persists longer than the OSGi bundle that created it, repeated operations such as installing, updating, or refreshing bundles and features can cause successive bundle ClassLoaders to remain pinned in memory. This prevents garbage collection, resulting in unbounded Metaspace growth and an eventual denial of service of the instance. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.