CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching
Apache Karaf versions before 4.4.11 pin bundle ClassLoaders in memory via static ThreadLocal caching, causing leaks (CVE-2026-92230, moderate).
Apache Karaf's XmlUtils caches XML parser and transformer factories in static ThreadLocal fields on long-lived container threads. Because ThreadLocal values outlive the OSGi bundles that created them, repeated bundle or feature install, update, or refresh operations leave successive bundle ClassLoaders pinned in memory and unreachable for garbage collection. The flaw affects Apache Karaf before 4.4.11 and is rated moderate severity.
- Fixed in Apache Karaf 4.4.11; earlier versions are affected.
- XML parser/transformer factories cached in static ThreadLocal fields on container threads.
- Repeated bundle install, update, or refresh operations accumulate unreachable ClassLoaders.
- CVEs
- CVE-2026-92230
- Vendors
- Apache
- Products
- Apache Karaf
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92230 | Metaspace-Exhaustion DoS in Apache Karaf via ClassLoader Leak in XmlUtils | 7.5 | — |
From the original article
Posted by Jean-Baptiste Onofré on Sep 17 Severity: moderate Affected versions: - Apache Karaf before 4. 4. 11 Description: Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.