SB20260917250 - Memory leak in Apache Karaf

Description

This security bulletin contains information about 1 vulnerability.

1) Memory leak (CVE-ID: CVE-2026-92230)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper release of ClassLoader references in the XmlUtils XML parser and transformer factory cache when repeatedly performing bundle or feature installation, update, or refresh operations. A local user can trigger repeated operations that leave successive bundle ClassLoaders pinned in memory to cause a denial of service.

ThreadLocal values can outlive the OSGi bundle that created them.

Remediation

Install update from vendor's website.

References

• https://lists.apache.org/api/email.lua?id=pxgqjvsmzgpvgly1qf1w300qxsp8bxdj
• https://github.com/apache/karaf/issues/2278