CVE-2026-92230

Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching

State: Published
Severity: 7.5 High
Published: Sep 17, 2026
Updated: Sep 18, 2026
Reserved: Sep 15, 2026

Description

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage collection, leading to unbounded Metaspace growth and eventual denial of service of the Karaf instance.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing release of memory after effective lifetime
CWE-772 Missing release of resource after effective lifetime

Affected Products

Product	Versions
Apache KarafApache Software Foundation	before 4.4.11Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.