VulnerableCode Package Details - pkg:maven/org.apache.karaf/apache-karaf@2.2.6

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.apache.karaf/apache-karaf@2.2.6

Essentials
History (4)

purl	pkg:maven/org.apache.karaf/apache-karaf@2.2.6

Next non-vulnerable version	4.2.3
Latest non-vulnerable version	4.3.6
Risk	4.0

Vulnerabilities affecting this package (4)

Vulnerability	Summary	Fixed by
VCID-3ej5-j7eg-2ffc Aliases: CVE-2016-8750 GHSA-chj8-5xgw-wcvj	Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.	4.0.8 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-gq9d-gg4k-ebhd Aliases: CVE-2018-11786 GHSA-9448-c9wq-jg9v		4.2.0 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-hf1y-5953-bkhc Aliases: CVE-2018-11787 GHSA-cq9c-55r7-455x		3.0.9 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.0.9 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.1.1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-vs7q-k273-4bcb Aliases: CVE-2019-0191 GHSA-869j-5855-hjpm	Path Traversal Apache Karaf kar deployer reads `.kar` archives and extracts the paths from the `repository/` and `resources/` entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it does not do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with `..` directory names and break out of the directories to write arbitrary content to the filesystem.	4.2.3 Affected by 0 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-05-31T09:54:58.478057+00:00	GitLab Importer	Affected by	VCID-vs7q-k273-4bcb	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.karaf/apache-karaf/CVE-2019-0191.yml	38.6.0
2026-05-31T09:52:52.042948+00:00	GitLab Importer	Affected by	VCID-hf1y-5953-bkhc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.karaf/apache-karaf/CVE-2018-11787.yml	38.6.0
2026-05-31T09:52:51.496555+00:00	GitLab Importer	Affected by	VCID-3ej5-j7eg-2ffc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.karaf/apache-karaf/CVE-2016-8750.yml	38.6.0
2026-05-31T09:52:36.254362+00:00	GitLab Importer	Affected by	VCID-gq9d-gg4k-ebhd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.karaf/apache-karaf/CVE-2018-11786.yml	38.6.0