CVE-2026-24656
📋 TL;DR
Apache Karaf Decanter's log socket collector has a deserialization vulnerability on port 4560 without authentication. Attackers can bypass allowed classes configuration to send malicious data, potentially causing denial of service. Only users who have installed the Decanter log socket collector are affected.
💻 Affected Systems
- Apache Karaf Decanter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if deserialization gadgets are available in the classpath
Likely Case
Denial of service through application crashes or resource exhaustion
If Mitigated
Limited impact if proper network segmentation and authentication controls are in place
🎯 Exploit Status
Exploitation requires sending specially crafted serialized objects to port 4560
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.12.0
Vendor Advisory: https://lists.apache.org/thread/dc5wmdn6hyc992olntkl75kk04ndzx34
Restart Required: Yes
Instructions:
1. Download Apache Karaf Decanter 2.12.0 or later. 2. Stop the Decanter service. 3. Replace the existing Decanter installation with the patched version. 4. Restart the Decanter service.
🔧 Temporary Workarounds
Disable Decanter log socket collector
allRemove or disable the vulnerable component if not required
Stop the Decanter service and remove/disable the log socket collector component
Network firewall restriction
linuxBlock access to port 4560 from untrusted networks
iptables -A INPUT -p tcp --dport 4560 -j DROP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="0.0.0.0/0" port port="4560" protocol="tcp" reject'
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the vulnerable service
- Add authentication or IP whitelisting to port 4560 access
🔍 How to Verify
Check if Vulnerable:
Check if Decanter log socket collector is installed and running on port 4560: netstat -tlnp | grep 4560Check Version:
Check Decanter version in application logs or configuration filesVerify Fix Applied:
Verify Decanter version is 2.12.0 or later and port 4560 is properly secured or disabled📡 Detection & Monitoring
Log Indicators:
- Deserialization errors in Decanter logs
- Unexpected connections to port 4560
- Java stack traces indicating deserialization failures
Network Indicators:
- Unusual traffic to port 4560 from external sources
- Malformed serialized objects sent to port 4560
SIEM Query:
source_port:4560 AND (event_type:connection OR event_type:deserialization_error)