CVE-2026-24656: 
Java vulnerability analysis and mitigation

CVE-2026-24656 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Apache Karaf Decanter Log Socket Collector component. The flaw was disclosed on January 24, 2026 via the oss-security mailing list and published to the NVD on January 26, 2026. It affects all versions of Apache Karaf Decanter before 2.12.0, specifically the org.apache.karaf.decanter.collector.log.socket Maven package. The vulnerability carries a CVSS v3.1 base score of 3.7 (Low) (GitHub Advisory, oss-security).

The root cause is improper deserialization of untrusted data (CWE-502) in the Decanter Log Socket Collector, which listens on TCP port 4560 without any authentication. The component supports an allowed classes configuration property intended to restrict which Java classes can be deserialized; however, this restriction can be bypassed, allowing an attacker to send a crafted serialized Java object to the open port and trigger unsafe deserialization. The attack vector is network-based, requires no privileges or user interaction, but is rated High complexity. The vulnerability was discovered by researcher r00t4dm and tracked in the Apache Karaf issue tracker as issue #555 (oss-security, GitHub Advisory).

Successful exploitation results in a Denial of Service (DoS) condition against the affected Decanter Log Socket Collector instance, with low availability impact and no confidentiality or integrity impact. The scope is unchanged, meaning the impact is confined to the vulnerable component itself. Because the Log Socket Collector is not installed by default, only deployments that have explicitly enabled this optional component are at risk (GitHub Advisory, oss-security).

1. Reconnaissance: Identify hosts running Apache Karaf with the Decanter Log Socket Collector installed and port 4560 exposed to the network, using tools such as Shodan, Censys, or Nmap (nmap -p 4560 <target>).
2. Verify exposure: Confirm the port is open and accepting TCP connections, indicating the Log Socket Collector is active.
3. Craft malicious payload: Construct a serialized Java object payload designed to exploit the deserialization endpoint. Tools such as ysoserial can generate gadget-chain payloads targeting common Java libraries present in the Karaf classpath.
4. Bypass allowed-classes filter: Exploit the configuration bypass to circumvent any allowed classes restriction that may be configured on the collector.
5. Send payload: Transmit the crafted serialized object directly to TCP port 4560 on the target host (e.g., using nc <target> 4560 < payload.ser).
6. Trigger DoS: The server deserializes the malicious object, causing a Denial of Service condition in the Log Socket Collector process (oss-security, GitHub Advisory).

• Network: Unexpected or anomalous TCP connections to port 4560 from untrusted or external IP addresses; large or malformed binary data streams sent to port 4560.
• Logs: Java deserialization exceptions or ClassNotFoundException / InvalidClassException errors in Karaf log files (e.g., karaf.log) associated with the log socket collector; sudden crashes or restarts of the Decanter Log Socket Collector service.
• Process: Unexpected JVM crashes or out-of-memory errors in the Karaf process coinciding with inbound connections on port 4560.
• File System: Presence of the org.apache.karaf.decanter.collector.log.socket bundle in a Karaf deployment that does not require it, indicating unnecessary attack surface exposure.

The primary remediation is to upgrade Apache Karaf Decanter to version 2.12.0 or later, which resolves the deserialization bypass (GitHub Advisory). Organizations that cannot immediately upgrade should implement network-level access controls (e.g., firewall rules) to restrict access to TCP port 4560 to only trusted log sources. Additionally, if the Decanter Log Socket Collector is not actively required, it should be uninstalled or disabled entirely, as it is not enabled by default (oss-security).

The vulnerability was disclosed by Apache committer Jean-Baptiste Onofré via the oss-security mailing list, crediting researcher r00t4dm as the finder. Security news outlet SecurityOnline.info covered the flaw, noting the deserialization risk in Apache Karaf. Social media activity on Bluesky and Mastodon was limited, reflecting the low severity and narrow impact scope of the vulnerability. No significant vendor statements beyond the Apache advisory or notable researcher commentary have been observed (oss-security).