-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching

Severity: moderate

Affected versions:

- - Apache Karaf before 4.4.11

Description:

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage collection, leading to unbounded Metaspace growth and eventual denial of service of the Karaf instance.

This issue is being tracked as https://github.com/apache/karaf/issues/2278 

Credit:

Baoquan Cui & Yucheng Qiu (reporter)

References:

https://karaf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-92230
https://issues.apache.org/jira/browse/https://github.com/apache/karaf/issues/2278
-----BEGIN PGP SIGNATURE-----

iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmqr6nIbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52p40P/R3b/84TGGjSpBGLsQSJ
V+jUn7PXGPkNx25f3osUYXhB0s1HaaQ9BNWiUMCEa0F8l8+NB8AMYoZFC1KGlDKD
dTps6yEH5nSmcHwa46MguO/27V9W1KozEvsA0VZ9dcvTrT2Qv52KSWDZahPo79xS
CyBKcncw846wTo02CPXFlVkDI/EmIYm2UXdIGY1HVGBAG6/C3XvfYY4+iCHP5CXL
PiAU8b2oWl6kI7+7sRCMI6EW7M0vutLv6cznKNvK0xfCt29aHaMH6nMtAROmWzYp
x8xdU3m9b/2WoeGDp2mHOx2W2hC2u3OrE1opswRIra8aiLhvLXiaLqlzxebhZn5r
8tJyfovAo01brIF2p0Maocrd5t6rNFlTXVFdb+2pmU/a7qSSRxg/9CYL/kMCdeB1
UNk+0gFNxCIQPLaEM8wR4T+m20tZ2AnQfCzT4ihxtqYCcxwIBsQ+S0QPdXSmmyCB
vZGs6nK0qI117GHsVyG8d+Pf929256IU7AXMKu4PzPGDXQrZyBzOSV+/PiuMAaBK
sk9tOhOqm/sEFw2c7/LaW1msy+K1RGjxTYWuD0KasvVrQY0nPt+ORUhlwC0GhoTs
RcuR7B3QOYVu++ULiGMKWnJg86XM+OoCHRaMrQN1DieCNFgf/tmPqFBx7Q8weY1Z
kcn3yO9M9UjYFzqs8pbQpjme
=vee7
-----END PGP SIGNATURE-----