Threats affecting pkg:github/logback-core

CVE-2026-10532 is a deserialization of untrusted data vulnerability in the logback-core component of QOS.CH Sarl's logback library, specifically in the HardenedObjectInputStream module. It allows an attacker who can influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer to instantiate Proxy objects, bypassing intended security restrictions. The vulnerability affects logback versions from 0 up to and including 1.5.33. No practical remote code execution or significant privilege escalation has been identified. The severity is rated low with a CVSS score of 2.9.

CVE-2026-9828 is a low-severity deserialization vulnerability in QOS.CH Sarl's logback-core module affecting versions prior to 1.5.33. It involves the HardenedObjectInputStream component, where an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate certain java.lang and java.util objects that are not explicitly blocked. Despite this, the deserialization restrictions are strong, and no practical remote code execution or significant privilege escalation has been identified.