A memory leak in Apache Karaf allows unauthenticated remote attackers to trigger a denial of service by causing unbounded Metaspace growth through repeated bundle operations.

The vulnerability exists in the XmlUtils component, which caches XML parser and transformer factories in static ThreadLocal fields on long-lived container threads. Because these values persist beyond the lifecycle of the OSGi bundle that created them, continuous bundle installations or updates cause memory exhaustion, which is achievable by an unauthenticated attacker.

The exploitation of this vulnerability results in a denial of service, rendering the Apache Karaf instance unavailable. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to system availability, particularly in environments that rely on frequent bundle management or automated deployments. Unplanned downtime can lead to operational disruption and potential failure of dependent services.

Immediate Action: Upgrade to Apache Karaf version 4.4.11 or later to implement the fix for the memory leak.

Proactive Monitoring: Monitor Metaspace usage and garbage collection metrics for anomalous growth patterns following bundle installation or refresh operations.

Compensating Controls: Restrict access to administrative interfaces or APIs that allow for bundle installations or updates to authorized personnel only to limit the attack surface.

Public Exploit Available: No (exploit_available: false)

Given the potential for complete service disruption through memory exhaustion, organizations utilizing Apache Karaf should prioritize updating to version 4.4.11. While no public exploit is currently observed, the ease of triggering this condition makes patching the most effective strategy for maintaining service stability.