CVE-2019-0191: Apache Karaf Zip-slip Vulnerability
Summary
CVE-2019-0191: Moderate severity vulnerability that affects org.apache.karaf:apache-karaf and org.apache.karaf:karaf. Affects org.apache.karaf:karaf versions < 4.2.3. Fixed in 4.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Karaf is an open-source OSGi-based runtime container for deploying and managing applications. It provides a lightweight and flexible platform for building, deploying, and running enterprise applications. The vulnerability affects the org.apache.karaf:apache-karaf and org.apache.karaf:karaf packages. These packages include a kar deployer that reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. However, it does not validate the paths, allowing a malicious user to craft a .kar file with ".." directory names and break out of the directories to write arbitrary content to the filesystem. This vulnerability is known as the Zip-slip vulnerability.
Vulnerability Detail
The Zip-slip vulnerability in Apache Karaf allows an attacker to escape the intended directories and write arbitrary content to the filesystem. By including ".." directory names in a crafted .kar file, an attacker can traverse the directory structure and overwrite files outside of the intended directories. This can lead to unauthorized access, data loss, or even remote code execution depending on the permissions of the Karaf process user. The vulnerability affects all Apache Karaf releases prior to version 4.2.3.
How To Fix
Latest published version: 4.4.12 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.2.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of Apache Karaf to mitigate the risk of exploitation.
Conclusion
The Zip-slip vulnerability in Apache Karaf poses a moderate risk to systems running affected versions. To ensure the security of your applications, it is recommended to update to Apache Karaf version 4.2.3 or later. This update includes the necessary validation to prevent the Zip-slip vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.karaf:karaf →
FAQ
Apache Karaf is an open-source OSGi-based runtime container for deploying and managing applications. It provides a lightweight and flexible platform for building, deploying, and running enterprise applications.
The Zip-slip vulnerability is a security issue that allows an attacker to break out of the intended directories and write arbitrary content to the filesystem by manipulating paths in a zip file. In the case of Apache Karaf, this vulnerability can be exploited by crafting a .kar file with ".." directory names.
The consequences of this vulnerability can vary depending on the permissions of the Karaf process user. In the worst case, an attacker could gain unauthorized access, cause data loss, or even execute remote code by overwriting critical files outside of the intended directories.
All Apache Karaf releases prior to version 4.2.3 are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is essential to update to the fixed version of Apache Karaf to mitigate the risk of exploitation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
