CVE-2026-92230

7.5 highEPSS 0.5%

High (7.5). EPSS 0.5% chance of exploitation in the next 30 days.

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage collection, leading to unbounded Metaspace growth and eventual denial of service of the Karaf instance.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWEs: CWE-401, CWE-772
Published: 2026-09-17
Modified: 2026-09-18
Record from: the NVD, synced 2026-10-19

References

https://lists.apache.org/thread/pxgqjvsmzgpvgly1qf1w300qxsp8bxdj
http://www.openwall.com/lists/oss-security/2026/09/17/3

Check your stack JSON