The vulnerability stems from the Deserialization of Untrusted Data in the Decanter log socket collector of Apache Karaf. When an unauthenticated client connects to the exposed port 4560 and sends malicious payloads, the collector processes them without proper validation, potentially triggering DoS conditions. This weakness is classified as CWE‑502, encompassing insecure deserialization threats.

The issue affects Apache Karaf Decanter versions prior to 2.12.0. The log socket collector is not installed by default; therefore, only deployments that have installed Decanter and left the collector enabled are impacted. The unprotected port 4560 serves as the attack surface.

The CVSS score of 3.7 indicates a low overall severity, and the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not currently listed in the CISA KEV catalog. An attacker can exploit the flaw by sending crafted serialized objects to the collector; if the configuration exposes allowed classes, authentication bypass may occur, leading to service disruption.