CVE-2026-24656

Name of the Vulnerable Software and Affected Versions Apache Karaf Decanter versions prior to 2.12.0

Description The Decanter log socket collector in Apache Karaf has a deserialization issue. The collector operates on port 4560 without authentication. If the allowed classes property is exposed, its configuration can be bypassed, leading to potential denial-of-service (DoS) conditions due to untrusted data deserialization. The Decanter log socket collector is not installed by default, meaning users who have not installed it are not affected.

Recommendations Upgrade to version 2.12.0 or later.