This vulnerability involves the deserialization of untrusted data in the HardenedObjectInputStream module of QOS.CH Sarl's logback-core. It allows an attacker with the ability to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer to instantiate Proxy objects, effectively bypassing some security restrictions. Despite this bypass, the deserialization process is heavily restricted, and no practical exploitation leading to remote code execution or significant privilege escalation has been demonstrated. The vulnerability affects logback versions up to and including 1.5.33.

The impact is limited to bypassing intended security restrictions in the deserialization process. There is no known practical method to achieve remote code execution or significant privilege escalation through this vulnerability. The CVSS score of 2.9 reflects a low severity, indicating minimal impact under current knowledge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or remediation level has been published at this time. Users should monitor vendor communications for updates. Given the low severity and restricted exploitation potential, immediate urgent action is not indicated.