Threats Tagged 'ghsa-3c25-9cqf-vxfc'

CVE-2026-92230 is a high-severity vulnerability in Apache Karaf where static ThreadLocal fields cache XML parser/transformer factories on long-lived container threads. This causes memory from successive bundle ClassLoaders to be retained and unreachable for garbage collection after bundle lifecycle operations, leading to unbounded Metaspace growth and potential denial of service.