As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching
Apache Karaf before version 4.4.11 contains a memory leak vulnerability where XML parser and transformer factories cached in static ThreadLocal fields retain references to bundle ClassLoaders. Repeated bundle or feature install, update, or refresh operations cause successive ClassLoaders to remain pinned in memory and unreachable for garbage collection, potentially degrading performance over time.
Why it matters: Organizations running Apache Karaf containers need to upgrade to version 4.4.11 or later to prevent ClassLoader exhaustion and memory degradation from accumulated bundle operations in long-lived environments.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching
CVE-2026-92230 affects Apache Karaf before version 4.4.11 and involves improper release of ClassLoader references through static ThreadLocal caching in XML utilities. Repeated bundle or feature install, update, or refresh operations can pin successive bundle ClassLoaders in memory, preventing garbage collection.
Why it matters: Organizations running Apache Karaf should upgrade to 4.4.11 or later to prevent memory leaks that degrade container performance during bundle lifecycle operations.
- Source published
- First seen by Cybersecurity Tracker