CVE-2026-24656
Low · 3.7Apache Karaf Decanter has Deserialization of Untrusted Data in its Log Socket Collector
CVSS
3.7
EPSS
0.7%
Published
Jan 26, 2026
CISA due date
—
The record
Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter Log Socket Collector exposes port 4560 without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. The Log Socket Collector is vulnerable to deserialization of untrusted data, eventually causing DoS. NB: Decanter Log Socket Collector is not installed by default. Users who have not installed the Decanter Log Socket are not impacted by this issue. This issue affects Apache Karaf Decanter before 2.12.0. Users are recommended to upgrade to version 2.12.0, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.karaf.decanter.collector:org.apache.karaf.decanter.collector.log.socket | 0 | 2.12.0 |
Related vulnerabilities
- GHSA-jmw5-58c7-587h Apache Karaf Decanter has Deserialization of Untrusted Data in its Log Socket Collector Same vulnerability
- CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection… CWE-502
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-502
- CVE-2026-96745 Deserialization of untrusted data in the command monitoring support of the MongoDB PHP… CWE-502
- CVE-2026-62107 Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions. CWE-502
- CVE-2026-62103 Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions. CWE-502
- CVE-2026-62105 Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions. CWE-502
- CVE-2026-73699 FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows… CWE-502