CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching

Apache Karaf's XmlUtils caches XML parser and transformer factories in static ThreadLocal fields on long-lived container threads. Because ThreadLocal values outlive the OSGi bundle that created them, each bundle or feature install, update, or refresh operation pins that bundle's ClassLoader in memory where it can never be garbage collected. Repeated dynamic lifecycle operations therefore drive unbounded Metaspace growth until the Karaf instance exhausts memory and is denied service. Exploitation requires the ability to trigger repeated bundle/feature operations, meaning an attacker would typically need management access (Karaf shell, JMX, or web console) or control of an automated deployment pipeline, though internal CI/CD-driven deployments can be affected without any attacker. The issue is not yet CVSS-scored, is not in CISA KEV, and no public proof-of-concept or in-the-wild exploitation is known.

Do: Upgrade Apache Karaf to the patched release referenced in the Apache security advisory once published, since no fixed version is stated in the available data. Until patched, restrict Karaf shell, JMX, and Hawtio/webpack console access to trusted administrators and avoid frequent automated bundle/feature install-update-refresh cycles in production. Monitor JVM Metaspace consumption and restart instances showing steady growth.