This vulnerability involves deserialization of untrusted data in the HardenedObjectInputStream module of logback-core, which is part of the logback logging framework by QOS.CH Sarl. An attacker capable of controlling serialized input to the SimpleSocketServer or SimpleSSLSocketServer can cause instantiation of Proxy objects, effectively bypassing some security restrictions. Despite this bypass, no confirmed remote code execution or major privilege escalation has been demonstrated. The issue affects all logback versions from 0 up to and including 1.5.33. There is no vendor advisory or patch information available at this time.

The vulnerability allows restricted object injection via deserialization, which bypasses intended security restrictions in the logback-core HardenedObjectInputStream module. However, no practical remote code execution or significant privilege escalation has been identified, limiting the impact to a low severity level. Attackers must be able to influence serialized data sent to specific socket servers to exploit this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or vendor advisory is provided, users should monitor for updates from QOS.CH Sarl. Until a patch is available, avoid exposing SimpleSocketServer or SimpleSSLSocketServer to untrusted serialized data inputs to reduce risk.