Denial of Service Vulnerability in Apache Karaf's XML Parser

CVE-2026-92230

What is CVE-2026-92230?

Apache Karaf's XML parser leverages cached parser and transformer factories stored in static ThreadLocal fields associated with long-lived container threads. Due to the persistence of ThreadLocal values beyond the lifecycle of the OSGi bundle that instantiated them, repeated installations, updates, or refresh operations can result in successive bundle ClassLoader instances remaining in memory. This unintended behavior can lead to unbounded growth of Metaspace, ultimately causing denial of service for the Karaf instance as resources become exhausted and the system becomes unable to service requests.

References