CVE-2026-92230— Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching
Quick assessment
Affected
Apache Software Foundation Apache Karaf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Karaf 的 类在长期存活的容器线程中，将 XML 解析器和转换器工厂缓存于静态的 字段中。由于 中的值的生命周期超出了创建它的 OSGi Bundle 的生命周期，反复执行 Bundle 或 Feature 的安装、更新或刷新操作时，可能导致后续 Bundle 的 ClassLoader 被持续保留在内存中且无法被垃圾回收机制清理，从而引发 Metaspace 无限制增长，最终导致 Karaf 实例拒绝服务（DoS）。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Karaf | < 4.4.11 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92230
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching
Source: CVE Program / CVE List V5
Vulnerability Description
Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage collection, leading to unbounded Metaspace growth and eventual denial of service of the Karaf instance.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Karaf | 0 ~ 4.4.11 | - |
|
II. Public POCs for CVE-2026-92230
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92230
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-92230 (1)
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-75157
Apache Airflow: Asset queued-events DELETE endpoints gated o -
CVE-2026-70469
Apache NiFi: Improper Handling of Case Sensitivity for Conte -
CVE-2026-81866
Apache NiFi: Missing Authorization for Assets and Secrets Re -
CVE-2026-82561
Apache NiFi: Missing Authorization for Components Referenced -
CVE-2026-86089
Apache NiFi: Missing Process Group Authorization for Connect
Same weakness: CWE-401
-
CVE-2026-63446
Suricata app-layer: passed flows can retain transactions, ca -
CVE-2026-93436
vLLM through 0.29.0 Memory Exhaustion via Rejected Requests -
CVE-2026-20222
Cisco Secure Adaptive Security Appliance Software and Secure -
CVE-2026-18212
Keycloak-services: keycloak-services: saml redirect deflate -
CVE-2026-81563
SVCB AliasMode additional-data error leaks qpcache reference
V. Comments for CVE-2026-92230
No comments yet