Skip to content
Fencer Vulns
high 8.1

CVE-2021-41766 json

Insecure Java Deserialization in Apache Karaf

published 2022-01-26 4 y ago modified 2026-06-17 4 mo ago also GHSA-jh5g-9m4v-9vv9 , EUVD-2022-0628

cvss
8.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder).

Patch / fix

  • maven org.apache.karaf.management:org.apache.karaf.management.server 4.3.6
  • Apache Software Foundation Apache Karaf 4.3.6

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-41766 updated cvss 8.1

karaf: insecure java deserialization

  • Red Hat BPM Suite 6 karaf karaf Red Hat JBoss A-MQ 6 karaf karaf Red Hat JBoss BRMS 6 karaf karaf Red Hat JBoss Data Grid 7 karaf karaf Red Hat JBoss Fuse 6 karaf karaf Red Hat JBoss Fuse Service Works 6 karaf karaf
    affected: no fix planned “Out of support scope”
  • Red Hat Fuse 7.11
    fixed: vendor fix RHSA-2022:5532
  • Red Hat Decision Manager 7 karaf karaf Red Hat Integration Camel K 1 karaf karaf Red Hat Integration Camel Quarkus 1 karaf karaf Red Hat Process Automation 7 karaf karaf
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.03% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
GitHub 3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.karaf.management:org.apache.karaf.management.server
<4.3.6
4.3.6

Affected products

  • Apache Software Foundation Apache Karaf

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.