CVE-2023-6481

Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

7.1 HighFix available

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.68%Up 0.6 points since Dec 4, 2023

What each source reports

CVE List Score used 7.1

Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

Record: CVE-2023-6481
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated: 2026-11-02

EUVDEUVD-2023-3212 7.1

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

Record: EUVD-2023-3212
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gm62-rw4g-vrc4 7.1

Logback is vulnerable to an attacker mounting a Denial-Of-Service attack by sending poisoned data

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

Record: GHSA-gm62-rw4g-vrc4
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated: 2026-11-02

NVD 7.1

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

Record: CVE-2023-6481
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.1

Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

Record: CVE-2023-6481
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-gm62-rw4g-vrc4 7.1

Logback is vulnerable to an attacker mounting a Denial-Of-Service attack by sending poisoned data

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

Record: GHSA-gm62-rw4g-vrc4
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2023-1946 7.5

logback security update

Logback is intended as a successor to the popular log4j project.

Security Fix(es):

A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

(CVE-2023-6378)

A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

(CVE-2023-6481)

Record: OESA-2023-1946
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2023-6481 7.1

CVE-2023-6481 in io.root.ch.qos.logback:logback-core - Patched by Root

Root has patched CVE-2023-6481 in the io.root.ch.qos.logback:logback-core package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2023-6481
CVSS 3.1: 7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15597-1 No score

logback-1.2.13-1.1 on GA media

These are all security issues fixed in the logback-1.2.13-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15597-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`ch.qos.logback:logback-core` Maven	1.4.13 to 1.4.13	1.4.14
`ch.qos.logback:logback-core` Maven	1.3.13 to 1.3.13	1.3.14
`ch.qos.logback:logback-core` Maven	1.2.12 to 1.2.12	1.2.13
`ch.qos.logback:logback-core` Maven	1.4.13 up to 1.4.14	1.4.14
`ch.qos.logback:logback-core` Maven	1.3.13 up to 1.3.14	1.3.14
`ch.qos.logback:logback-core` Maven	1.2.12 up to 1.2.13	1.2.13
`logback` openEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs	before 1.2.8-3.oe1	1.2.8-3.oe1
`logback` openEuler:20.03-LTS-SP3 From an advisory covering 2 CVEs	before 1.2.8-3.oe1	1.2.8-3.oe1
`logback` openEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs	before 1.2.8-3.oe2003sp4	1.2.8-3.oe2003sp4
`logback` openEuler:22.03-LTS From an advisory covering 2 CVEs	before 1.2.8-3.oe2203sp2	1.2.8-3.oe2203sp2
`logback` openEuler:22.03-LTS-SP1 From an advisory covering 2 CVEs	before 1.2.8-3.oe2203sp1	1.2.8-3.oe2203sp1
`logback` openEuler:22.03-LTS-SP2 From an advisory covering 2 CVEs	before 1.2.8-3.oe2203sp2	1.2.8-3.oe2203sp2
`logback` openSUSE:Tumbleweed From an advisory covering 3 CVEs	before 1.2.13-1.1	1.2.13-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-6481 is a high vulnerability (CVSS 7.1) in Qos Logback, published December 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in ch.qos.logback:logback-core 1.4.14.

References

Show 6 moreShow less