CVE-2026-92230
Description
A flaw was found in Apache Karaf's XmlUtils. This vulnerability arises from the caching of XML parser and transformer factories in static ThreadLocal fields within long-lived container threads. Repeated operations such as installing, updating, or refreshing OSGi (Open Services Gateway initiative) bundles can cause the ClassLoaders associated with these bundles to remain in memory. This leads to uncontrolled growth of the Metaspace, eventually resulting in a denial of service for the Karaf instance.
Statement
This vulnerability is rated as Important severity because it can cause a complete denial of service across the entire container runtime when class loader leaks progressively exhaust the Java Metaspace. In Red Hat environments utilizing Apache Karaf, continuous redeployment, updating, or refreshing of OSGi bundles or integration features retains class references on persistent worker threads. While triggering this condition requires repeated lifecycle operations during runtime, the resulting OutOfMemoryError terminates the container process and disrupts all hosted services.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
