CVE-2026-9828: CWE-502 Deserialization of untrusted data in QOS.CH Sarl logback
Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from classes in the java.lang and java.util packages that are not explicitly blocked. Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions. This issue affects logback: through 1.5.32 inclusive.
AI Analysis
Technical Summary
This vulnerability involves the deserialization of untrusted data in the HardenedObjectInputStream component of the logback-core module by QOS.CH Sarl. Attackers able to control serialized input to SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from some classes in java.lang and java.util that are not blocked. Despite this, the deserialization process is heavily restricted, preventing practical remote code execution or major privilege escalation. The issue affects logback versions through 1.5.32 inclusive. The CVSS 4.0 base score is 1.2, indicating low severity.
Potential Impact
The impact is limited to bypassing some of the intended security restrictions on deserialization. No practical remote code execution or significant privilege escalation has been demonstrated. The vulnerability allows object instantiation from certain allowed classes but does not enable attackers to execute arbitrary code or gain elevated privileges.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor vendor communications for updates and consider restricting access to SimpleSocketServer and SimpleSSLSocketServer interfaces to trusted sources as a precaution.
CVE-2026-9828: CWE-502 Deserialization of untrusted data in QOS.CH Sarl logback
Description
Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from classes in the java.lang and java.util packages that are not explicitly blocked. Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions. This issue affects logback: through 1.5.32 inclusive.
CVSS v4.0
Score 2.9low
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves the deserialization of untrusted data in the HardenedObjectInputStream component of the logback-core module by QOS.CH Sarl. Attackers able to control serialized input to SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from some classes in java.lang and java.util that are not blocked. Despite this, the deserialization process is heavily restricted, preventing practical remote code execution or major privilege escalation. The issue affects logback versions through 1.5.32 inclusive. The CVSS 4.0 base score is 1.2, indicating low severity.
Potential Impact
The impact is limited to bypassing some of the intended security restrictions on deserialization. No practical remote code execution or significant privilege escalation has been demonstrated. The vulnerability allows object instantiation from certain allowed classes but does not enable attackers to execute arbitrary code or gain elevated privileges.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Users should monitor vendor communications for updates and consider restricting access to SimpleSocketServer and SimpleSSLSocketServer interfaces to trusted sources as a precaution.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- NCSC.ch
- Date Reserved
- 2026-05-28T11:55:19.674Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a184ec2e29bf47b50f3f931
Added to database: 5/28/2026, 2:18:42 PM
Last enriched: 5/28/2026, 2:34:28 PM
Last updated: 5/29/2026, 1:02:36 PM
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.