CVE-2024-34365

9.1 criticalEPSS 1.2%Unsupported when assigned

Critical (9.1) in apache karaf cave. No vendor fix: the product was unsupported when the CVE was assigned. EPSS 1.2% chance of exploitation in the next 30 days.

Improper Input Validation vulnerability in Apache Karaf Cave.This issue affects all versions of Apache Karaf Cave. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2024-05-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:karaf_cave

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-338x-hfx8-vx9x	Maven	org.apache.karaf:cave	<=4.1.2	no fix published

References

Check your stack JSON