Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8

Export CSV
CVE-2025-11226

Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must  have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Qos Qos.ch Sarl
Products
Logback Logback-core
CVE-2026-10532

Logback deserialization whitelist bypass for Proxy objects

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects. Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions. This issue affects logback: through 1.5.33 inclusive.

CVSS 4.0 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Qos
Products
Logback
CVE-2026-9828

Logback deserialization whitelist bypass for java.lang and java.util

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from classes in the java.lang and java.util packages that are not explicitly blocked. Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions. This issue affects logback: through 1.5.32 inclusive.

CVSS 4.0 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Qos
Products
Logback
CVE-2026-1225

Malicious logback.xml configuration file allows instantiation of arbitrary classes

ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed
Vendors
Qos
Products
Logback
CVE-2017-5929

logback: Serialization vulnerability in SocketServer and ServerSocketReceiver

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.

CVSS 3.1 · 9.8 Critical EPSS 7.5% KEV · Not listed
Vendors
Qos Redhat
Products
Logback Jboss Amq Jboss Bpms and 4 more
CVE-2023-6378

Logback "receiver" DOS vulnerability

A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Qos Redhat
Products
Logback Amq Broker Camel Spring Boot and 2 more
CVE-2023-6481

Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Qos Redhat
Products
Logback Amq Broker Camel Spring Boot and 3 more
CVE-2021-42550

RCE from attacker with configuration edit priviledges through JNDI lookup

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

CVSS 3.1 · 6.6 Medium EPSS 4.8% KEV · Not listed
Vendors
Netapp Qos Redhat and 1 more
Products
Cloud Manager Service Level Manager Snap Creator Framework and 6 more