EUVD-2026-82394
GHSA-3c25-9cqf-vxfc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Trigger is repeated privileged bundle-management operations (PR:H, local/management-plane AV:L) that only cause DoS after cumulative Metaspace exhaustion (AC:H), availability-only impact A:H.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
7Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Metaspace exhaustion in Apache Karaf before 4.4.11 allows an operator with access to Karaf's bundle- and feature-management surface (SSH console, JMX, or feature deployment) to crash the container by repeatedly installing, updating, or refreshing bundles and features. Each lifecycle cycle leaves the previous bundle ClassLoader pinned in memory via static ThreadLocal caches in XmlUtils, so Metaspace grows without bound until the JVM or the Karaf instance fails - a pure availability impact (CWE-401, missing release of memory). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the ability to perform repeated bundle or feature install/update/refresh operations against a running Apache Karaf instance (versions before 4.4.11) that uses XmlUtils - i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates this as HIGH and pure-availability, but that scoring is questionable and likely inflates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Karaf 4.4.11 or later, which is the first release above the affected range and is the vendor-released fix for the ThreadLocal classloader-retention defect (Vendor-released patch: 4.4.11); the release guidance and advisory are linked from https://karaf.apache.org/ and the Apache mailing list thread https://lists.apache.org/thread/pxgqjvsmzgpvgly1qf1w300qxsp8bxdj, with the oss-security advisory at https://seclists.org/oss-sec/2026/q3/816. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache Karaf instances and identify any running versions prior to 4.4.11; for internet-facing or high-churn systems, immediately restrict access to bundle and feature management surfaces (SSH console, JMX) to trusted operators only, and enforce JVM Metaspace limits as a temporary safeguard. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. Rated high severity (CVSS 8.1), this vulne
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the
In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the runni
In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available
OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used u
Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in
In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. Rated medium severity
Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial
Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directo
Same weakness CWE-401 – Memory Leak
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today