Memory leak in Apache Karaf - CVE-2026-92230
Published: September 17, 2026
Vulnerability identifier: #VU150745
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-92230
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper release of ClassLoader references in the XmlUtils XML parser and transformer factory cache when repeatedly performing bundle or feature installation, update, or refresh operations. A local user can trigger repeated operations that leave successive bundle ClassLoaders pinned in memory to cause a denial of service.
ThreadLocal values can outlive the OSGi bundle that created them.
Affected software
Apache Karaf
How to mitigate CVE-2026-92230
Install security update from vendor's website.
Apache Karaf - update to 4.4.11