Read the docs
TI-2014-00212 Aliases CVE-2014-0219GHSA-m6g3-xq5q-4hg9

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which…

Priority LOW 26CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shutdown command to all listening high ports.

Why it matters now

EPSS 0.00697 53rd percentileScored 2026-11-07
Fix Fixed org.apache.karaf:apache-karaf (Maven): 4.0.10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.karaf:apache-karaf (Maven)before 4.0.104.0.10Patch availableGHSA-m6g3-xq5q-4hg9
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.karaf:apache-karaf (Maven) Vendor— Affected before 4.0.10 Fixed in 4.0.10 Patch available GHSA-m6g3-xq5q-4hg9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*before 4.0.10VulnerableApache
  • cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:* Versions before 4.0.10 Vulnerable ·Apache

Remediation

  • Fix · GHSA-m6g3-xq5q-4hg9 org.apache.karaf:apache-karaf (Maven) Fixed in 4.0.10 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat BPM Suite 6
  • Red Hat JBoss BRMS 6
  • Red Hat JBoss Fuse Service Works 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0219
  2. 2026-10-03 Alias added: GHSA-m6g3-xq5q-4hg9

References

Advisory 3

  • TI-2022-19035 Apache Karaf: JDBC JAAS LDAP injection CVSS 3.1CRITICAL 9.8
  • TI-2018-08445 XML external entity injection in Apache Karaf CVSS 3.0CRITICAL 9.8
  • TI-2026-61863 Missing authorization in Apache Karaf CVSS 3.1CRITICAL 9.8
  • TI-2026-61851 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation CVSS 3.1CRITICAL 9.8
  • TI-2020-17076 An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. CVSS 3.1HIGH 8.1
  • TI-2026-61846 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) CVSS 3.1HIGH 8.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences