https://seclists.org/oss-sec/2026/q3/816: CVE-2026-92230: Apache Karaf: Improper lease of ClassLoader fences via static ThadLocal caching

Q: Which deployments are most exposed to this issue?

Karaf instances that repeatedly install, update, refresh, or otherwise cycle bundles or features are exposed to accumulating retained bundle ClassLoaders. The impact is unbounded Metaspace growth that can eventually deny service to the Karaf instance.

Q: What would an attacker need to do to trigger the denial of service?

The issue is triggered through repeated bundle or feature install, update, or refresh operations. An attacker would therefore need a way to cause or induce those lifecycle operations repeatedly.

Q: How can administrators identify a potentially affected instance?

A potentially affected instance is running a Karaf version before 4.4.11 and has undergone repeated bundle or feature lifecycle operations. The observable consequence described is continued Metaspace growth caused by prior bundle ClassLoaders remaining unreachable for garbage collection.

Q: What version resolves the issue?

Apache Karaf 4.4.11 is not listed as affected; versions before 4.4.11 are affected.

Published Sep 17, 2026

Updated

Affected Software

1 affected component

Apache Karaf<4.4.11

Frequently Asked Questions

Which deployments are most exposed to this issue?

Karaf instances that repeatedly install, update, refresh, or otherwise cycle bundles or features are exposed to accumulating retained bundle ClassLoaders. The impact is unbounded Metaspace growth that can eventually deny service to the Karaf instance.

What would an attacker need to do to trigger the denial of service?

The issue is triggered through repeated bundle or feature install, update, or refresh operations. An attacker would therefore need a way to cause or induce those lifecycle operations repeatedly.

How can administrators identify a potentially affected instance?

A potentially affected instance is running a Karaf version before 4.4.11 and has undergone repeated bundle or feature lifecycle operations. The observable consequence described is continued Metaspace growth caused by prior bundle ClassLoaders remaining unreachable for garbage collection.

What version resolves the issue?

Apache Karaf 4.4.11 is not listed as affected; versions before 4.4.11 are affected.