CVE-2026-24656: Apache Karaf Decanter Log Socket Collector Deserialization Vulnerability
Summary
CVE-2026-24656: Apache Karaf Decanter has Deserialization of Untrusted Data in its Log Socket Collector. Affects org.apache.karaf.decanter.collector:org.apache.karaf.decanter.collector.log.socket versions < 2.12.0. Fixed in 2.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Karaf Decanter is a monitoring tool that collects and analyzes logs from various sources. It provides features for real-time data collection and analysis, making it a valuable asset for developers and system administrators. The Decanter Log Socket Collector, a component of this tool, is designed to receive log data over a network socket. However, it has a critical vulnerability that can expose systems to deserialization attacks if not properly secured.
Vulnerability Detail
The vulnerability in Apache Karaf Decanter arises from the Log Socket Collector exposing port 4560 without authentication. This allows unauthorized users to send malicious data that can be deserialized by the collector. If the collector's allowed classes property is misconfigured, this can lead to a denial of service (DoS) attack. The issue affects versions prior to 2.12.0, and users who have not installed the Decanter Log Socket Collector are not impacted.
How To Fix
Minimum fixed version
2.12.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the Log Socket Collector if it is not needed, or ensure that it is properly secured behind a firewall to restrict access to trusted sources only.
Conclusion
In summary, the deserialization vulnerability in Apache Karaf Decanter's Log Socket Collector poses a risk to systems that have this component installed. Users are strongly advised to upgrade to version 2.12.0 or later to mitigate this risk. For those unable to upgrade immediately, implementing workarounds can help reduce exposure.
See every vulnerability recorded for org.apache.karaf.decanter.collector:org.apache.karaf.decanter.collector.log.socket →
FAQ
The vulnerability can lead to deserialization of untrusted data, potentially causing a denial of service (DoS) attack.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
No, the Decanter Log Socket Collector is not installed by default. Only users who have explicitly installed it are at risk.
If an immediate upgrade is not possible, consider disabling the Log Socket Collector or securing it behind a firewall.
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
