CVE-2026-92230

High

Description

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage collection, leading to unbounded Metaspace growth and eventual denial of service of the Karaf instance.

SeverityHigh

CVSS7.5

Exploit probability—

ProductApache Karaf

PublishedSep 17, 2026

First seenSep 17, 2026

Weakness typeCWE-401CWE-401 CWE-772CWE-772

How to fix

Update

Apache Software Foundation Apache Karaf4.4.11 or later

Vendor advisories

lists.apache.org/thread/pxgqjvsmzgpvgly1qf1w300qxsp8bxdj

Affected products

Product	Affected versions	Fixed in
Apache Software Foundation Apache Karaf	v < 4.4.11	4.4.11

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.