Threats affecting pkg:maven/ch.qos.logback/logback-core

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library to be present on the user's class path. In addition, the attacker must  have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege. Please note that in logack version 1.5.37 conditional processing using Janino was removed.

CVE-2026-10532 is a deserialization of untrusted data vulnerability in the logback-core component of QOS.CH Sarl's logback library, specifically in the HardenedObjectInputStream module. It allows an attacker who can influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer to instantiate Proxy objects, bypassing intended security restrictions. The vulnerability affects logback versions from 0 up to and including 1.5.33. No practical remote code execution or significant privilege escalation has been identified. The severity is rated low with a CVSS score of 2.9.

CVE-2026-9828 is a low-severity deserialization vulnerability in QOS.CH Sarl's logback-core module affecting versions prior to 1.5.33. It involves the HardenedObjectInputStream component, where an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate certain java.lang and java.util objects that are not explicitly blocked. Despite this, the deserialization restrictions are strong, and no practical remote code execution or significant privilege escalation has been identified.

ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.

QOS.CH logback-core versions prior to 1.5.19 and 1.3.16 are vulnerable to an arbitrary code execution flaw in conditional configuration file processing. Exploitation requires the presence of the Janino library and Spring Framework on the class path, as well as write access to a logback configuration file or the ability to inject a malicious environment variable. The vulnerability allows attackers with existing privileges to execute arbitrary code by compromising or injecting configuration files.