CVE-2026-24656

Katalog CVE

CVSS 3.7 · Low EPSS 0,73%

Kerentanan Deserialization of Untrusted Data pada apache karaf decanter. Skor CVSS 3.1 3.7 (Low) menurut CISA ADP.

Deskripsi (NVD)

Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS. NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue. This issue affects Apache Karaf Decanter before 2.12.0. Users are recommended to upgrade to version 2.12.0, which fixes the issue.

Rincian

Terbit di NVD

26 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 52,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2026/01/24/1 mailing list · advisory pihak ketiga
• https://lists.apache.org/thread/dc5wmdn6hyc992olntkl75kk04ndzx34 mailing list