CVE-2026-24656: Apache Karaf Decanter DoS Vulnerability

CVE-2026-24656 Overview

A Deserialization of Untrusted Data vulnerability exists in Apache Karaf Decanter's log socket collector component. The vulnerability allows unauthenticated remote attackers to exploit the log socket collector which exposes port 4560 without authentication. When the collector exposes allowed classes property, this configuration can be bypassed, making the log socket collector vulnerable to deserialization of untrusted data that can lead to Denial of Service (DoS) conditions.

It's important to note that the Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue.

Critical Impact

Remote attackers can exploit the unauthenticated log socket collector on port 4560 to perform deserialization attacks, potentially causing service disruption through Denial of Service.

Affected Products

• Apache Karaf Decanter versions before 2.12.0
• Systems with the Decanter log socket collector installed and exposed on port 4560
• Environments where allowed classes property configuration is being relied upon for protection

Discovery Timeline

• 2026-01-26 - CVE-2026-24656 published to NVD
• 2026-01-27 - Last updated in NVD database

Technical Details for CVE-2026-24656

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The Apache Karaf Decanter log socket collector operates on port 4560 and accepts incoming log data. The core issue stems from the lack of authentication on this exposed port combined with an ability to bypass the allowed classes property configuration.

When Java deserialization occurs on untrusted data, attackers can craft malicious serialized objects that, when deserialized by the application, trigger unintended behavior. In this case, the vulnerability can be exploited to cause Denial of Service conditions by forcing the application to process maliciously crafted serialized data.

The attack requires network access to port 4560 where the log socket collector is listening. While the allowed classes property was intended to restrict which classes can be deserialized, this security control can be circumvented, rendering it ineffective against determined attackers.

Root Cause

The root cause is the insufficient access control on the log socket collector's network endpoint combined with inadequate validation of serialized data before deserialization. The allowed classes property mechanism was designed to whitelist acceptable classes for deserialization, but implementation flaws allow this restriction to be bypassed. This enables attackers to inject arbitrary serialized objects that the application will process, leading to resource exhaustion or other DoS conditions.

Attack Vector

The attack is network-based and does not require authentication or user interaction. An attacker with network access to the vulnerable service on port 4560 can send specially crafted serialized Java objects to the log socket collector. The attack exploits the following conditions:

1. The Decanter log socket collector must be installed and running (not a default configuration)
2. Port 4560 must be accessible to the attacker
3. The attacker crafts malicious serialized objects designed to bypass the allowed classes property
4. Upon deserialization, the malicious payload triggers resource consumption or crashes

The vulnerability mechanism involves sending specially crafted serialized Java objects to the exposed port 4560 of the Decanter log socket collector. These objects are designed to bypass the allowed classes property restrictions and, when processed by the deserialization mechanism, consume excessive resources or trigger application failures. For detailed technical information, refer to the Apache Security Mailing List.

Detection Methods for CVE-2026-24656

Indicators of Compromise

• Unusual network traffic or connection patterns to port 4560 from external or unexpected sources
• Increased resource consumption (CPU, memory) on systems running Apache Karaf Decanter
• Application crashes or service unavailability of the Decanter log socket collector
• Suspicious serialized Java object data in network captures targeting port 4560

Detection Strategies

• Monitor network connections to port 4560 for unusual source addresses or connection volumes
• Implement network-level alerting for connections to port 4560 from untrusted networks
• Deploy application performance monitoring to detect abnormal resource consumption in Karaf processes
• Use deep packet inspection to identify potentially malicious Java serialization streams

Monitoring Recommendations

• Configure firewall logging for all traffic to port 4560 and review regularly
• Implement network segmentation monitoring to ensure port 4560 is not exposed beyond intended boundaries
• Set up automated alerts for Karaf Decanter service disruptions or restarts
• Monitor system logs for deserialization-related exceptions or errors

How to Mitigate CVE-2026-24656

Immediate Actions Required

• Verify whether the Decanter log socket collector is installed in your environment
• If installed, upgrade Apache Karaf Decanter to version 2.12.0 or later immediately
• Implement firewall rules to restrict access to port 4560 to trusted sources only
• Consider disabling the log socket collector if it is not required for operations

Patch Information

Apache has released version 2.12.0 of Apache Karaf Decanter which addresses this vulnerability. Users are strongly recommended to upgrade to this version or later to remediate the issue. The fix implements proper validation and authentication controls for the log socket collector component.

For additional details, refer to the Apache Security Mailing List and the Openwall OSS Security Update.

Workarounds

• Disable the Decanter log socket collector if it is not essential for your deployment
• Implement strict firewall rules to block external access to port 4560
• Use network segmentation to isolate systems running the vulnerable component
• Deploy a reverse proxy or application gateway with authentication in front of the service

# Configuration example - Firewall rules to restrict access to port 4560
# Allow only trusted internal networks to access the Decanter log socket collector
iptables -A INPUT -p tcp --dport 4560 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 4560 -j DROP