CVE-2026-24656

Name: CVE-2026-24656
Creator: NVD / NIST
Published: 2026-01-26T10:16:09.597+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

LOWCVSS 3.7/10EPSS 0.66%

Last modified Jun 17, 2026

CVE-2026-24656 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS. NB: Decanter log socket collector is not installed by default. EPSS estimates a 0.66% chance of exploitation in the next 30 days.

Description

Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS. NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue. This issue affects Apache Karaf Decanter before 2.12.0. Users are recommended to upgrade to version 2.12.0, which fixes the issue.

Metrics

CVSS 3.1

3.7/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Probability

0.66%

46.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-502

Affected Software

Vendor	Product	Versions
Apache	Karaf Decanter	< 2.12.0

References

https://lists.apache.org/thread/dc5wmdn6hyc992olntkl75kk04ndzx34Mailing List
http://www.openwall.com/lists/oss-security/2026/01/24/1Mailing List, Third Party Advisory

Timeline

Published: Jan 26, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-24656?

How severe is CVE-2026-24656?

CVE-2026-24656 has a CVSS score of 3.7/10 (LOW severity). The EPSS model estimates a 0.66% probability of exploitation in the next 30 days.

How do I fix CVE-2026-24656?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-24656?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST