CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching

<p>Posted by Jean-Baptiste Onofré on Sep 17</p>Severity: moderate <br /> <br /> Affected versions:<br /> <br /> - Apache Karaf before 4.4.11<br /> <br /> Description:<br /> <br /> Apache Karaf&apos;s XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container <br /> threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bun