apache_karaf vulnerabilities

CVEs whose affected-version data names the apache_karaf package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-92230High· 7.5

5d ago

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, updat…

▾ TwilightApache Software Foundation · Apache KarafEPSS 0.40%via NVD