CVE-2025-11226
Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
- Record
CVE-2025-11226- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/S:P/AU:N/RE:M/U:Green - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2025-32903
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
- Record
EUVD-2025-32903- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/S:P/AU:N/RE:M/U:Green - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-25qh-j22f-pwp8
QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing
QOS.CH logback-core versions up to 1.5.18 contain an ACE vulnerability in conditional configuration file processing in Java applications. This vulnerability allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting a malicious environment variable before program execution.
A successful attack requires the Janino library and Spring Framework to be present on the user's class path. Additionally, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privileges.
- Record
GHSA-25qh-j22f-pwp8- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
- Record
CVE-2025-11226- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-11226
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
- Record
DEBIAN-CVE-2025-11226- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green - Updated
- 2026-11-02
OSVGHSA-25qh-j22f-pwp8
QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing
QOS.CH logback-core versions up to 1.5.18 contain an ACE vulnerability in conditional configuration file processing in Java applications. This vulnerability allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting a malicious environment variable before program execution.
A successful attack requires the Janino library and Spring Framework to be present on the user's class path. Additionally, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privileges.
- Record
GHSA-25qh-j22f-pwp8- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L - Weakness
- CWE-20
- Updated
- 2026-11-02
Show 17 moreShow less
OSVRHLW-2026-a08954ef69e23d40
Lightwell Security Advisory: logback-core 1.2.11.rhlw-00001
Red Hat Lightwell has released ch.qos.logback:logback-core 1.2.11.rhlw-00001 with backported fixes for CVE-2023-6378, CVE-2024-12798, CVE-2024-12801, CVE-2025-11226, CVE-2026-10532, CVE-2026-1225, and CVE-2026-9828.
CVE-2023-6378: Logback "receiver" DOS vulnerability
CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension.
A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
CVE-2024-12801: Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.
The attacks involves the modification of DOCTYPE declaration in XML configuration files.
CVE-2025-11226: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.
A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects
CVE-2026-1225: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.
The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.
CVE-2026-9828: Logback deserialization whitelist bypass for java.lang and java.util
This patched artifact is a drop-in replacement for ch.qos.logback:logback-core 1.2.11 from Maven Central.
- Record
RHLW-2026-a08954ef69e23d40- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:L/U:Clear - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-11226
CVE-2025-11226 in io.root.ch.qos.logback:logback-core - Patched by Root
Root has patched CVE-2025-11226 in the io.root.ch.qos.logback:logback-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2025-11226- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-11226
ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.
- Record
UBUNTU-CVE-2025-11226- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/S:P/AU:N/RE:M/U:Green - Updated
- 2026-11-02
OSVCLSA-2025-1754872136 No score
TuxCare security update for org.springframework.data:spring-data-r2dbc (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-r2dbc to address 2 CVEs. Fixed in 1.5.18-tuxcare.1.
- Record
CLSA-2025-1754872136- Updated
- 2026-11-02
OSVCLSA-2025-1762906009 No score
TuxCare security update for ch.qos.logback (4 CVEs)
TuxCare rebuilt 2 ch.qos.logback packages to address 4 CVEs. Fixed in 1.1.7-tuxcare.1.
- Record
CLSA-2025-1762906009- Updated
- 2026-11-02
OSVCLSA-2025-1764720467 No score
TuxCare security update for org.skyscreamer:jsonassert (1 CVE)
TuxCare rebuilt org.skyscreamer:jsonassert to address 1 CVE. Fixed in 1.2.3-tuxcare.1.
- Record
CLSA-2025-1764720467- Updated
- 2026-11-02
OSVCLSA-2025-1765930089 No score
TuxCare security update for ch.qos.logback:logback-core (1 CVE)
TuxCare rebuilt ch.qos.logback:logback-core to address 1 CVE. Fixed in 1.2.13-tuxcare.1.
- Record
CLSA-2025-1765930089- Updated
- 2026-11-02
OSVCLSA-2025-1767053309 No score
TuxCare security update for ch.qos.logback:logback-core (3 CVEs)
TuxCare rebuilt ch.qos.logback:logback-core to address 3 CVEs. Fixed in 1.4.14-tuxcare.1.
- Record
CLSA-2025-1767053309- Updated
- 2026-11-02
OSVCLSA-2026-1783558958 No score
TuxCare security update for ch.qos.logback:logback-core (2 CVEs)
TuxCare rebuilt ch.qos.logback:logback-core to address 2 CVEs. Fixed in 1.5.18-tuxcare.1.
- Record
CLSA-2026-1783558958- Updated
- 2026-11-02
OSVCLSA-2026-1784769539 No score
TuxCare security update for ch.qos.logback:logback-core (1 CVE)
TuxCare rebuilt ch.qos.logback:logback-core to address 1 CVE. Fixed in 1.4.11-tuxcare.1.
- Record
CLSA-2026-1784769539- Updated
- 2026-11-02
OSVCLSA-2026-1785917146 No score
TuxCare security update for ch.qos.logback:logback-core (1 CVE)
TuxCare rebuilt ch.qos.logback:logback-core to address 1 CVE. Fixed in 1.2.12-tuxcare.1.
- Record
CLSA-2026-1785917146- Updated
- 2026-11-02
OSVCLSA-2026-1786355016 No score
TuxCare security update for ch.qos.logback:logback-core (1 CVE)
TuxCare rebuilt ch.qos.logback:logback-core to address 1 CVE. Fixed in 1.2.3-tuxcare.1.
- Record
CLSA-2026-1786355016- Updated
- 2026-11-02
OSVCLSA-2026-1786547487 No score
TuxCare security update for org.springframework.pulsar (3 CVEs)
TuxCare rebuilt 6 org.springframework.pulsar packages to address 3 CVEs. Fixed in 1.2.13-tuxcare.1.
- Record
CLSA-2026-1786547487- Updated
- 2026-11-02
OSVCLSA-2026-1791881293 No score
TuxCare security update for ch.qos.logback:logback-core (3 CVEs)
TuxCare rebuilt ch.qos.logback:logback-core to address 3 CVEs. Fixed in 1.2.11-tuxcare.1.
- Record
CLSA-2026-1791881293- Updated
- 2026-11-02
OSVCLSA-2026-1792011837 No score
TuxCare security update for ch.qos.logback:logback-core (2 CVEs)
TuxCare rebuilt ch.qos.logback:logback-core to address 2 CVEs. Fixed in 1.2.5-tuxcare.1.
- Record
CLSA-2026-1792011837- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15597-1 No score
logback-1.2.13-1.1 on GA media
These are all security issues fixed in the logback-1.2.13-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15597-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03456-1 No score
Security update for logback
This update for logback fixes the following issues:
- CVE-2025-11226: fixed the ACE vulnerability in conditional configuration file processing (bsc#1250715)
- Record
SUSE-SU-2025:03456-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ch.qos.logback:logback-coreMaven |
1.4.0 up to 1.5.19 | 1.5.19 |
ch.qos.logback:logback-coreMaven |
before 1.3.16 | 1.3.16 |
ch.qos.logback:logback-classicTuxCare:Maven From an advisory covering 4 CVEs |
1.1.7 up to 1.1.7-tuxcare.1 | 1.1.7-tuxcare.1 |
ch.qos.logback:logback-coreTuxCare:Maven From an advisory covering 4 CVEs |
1.1.7 up to 1.1.7-tuxcare.1 | 1.1.7-tuxcare.1 |
ch.qos.logback:logback-coreTuxCare:Maven |
1.2.13 up to 1.2.13-tuxcare.1, plus listed versions 1.2.13.tuxcare |
1.2.13-tuxcare.1 |
ch.qos.logback:logback-coreTuxCare:Maven From an advisory covering 3 CVEs |
1.4.14 up to 1.4.14-tuxcare.1 | 1.4.14-tuxcare.1 |
ch.qos.logback:logback-coreTuxCare:Maven From an advisory covering 2 CVEs |
1.5.18 up to 1.5.18-tuxcare.1 | 1.5.18-tuxcare.1 |
ch.qos.logback:logback-coreTuxCare:Maven |
1.4.11 up to 1.4.11-tuxcare.1 | 1.4.11-tuxcare.1 |
ch.qos.logback:logback-coreTuxCare:Maven |
1.2.12 up to 1.2.12-tuxcare.1 | 1.2.12-tuxcare.1 |
ch.qos.logback:logback-coreTuxCare:Maven |
1.2.3 up to 1.2.3-tuxcare.1 | 1.2.3-tuxcare.1 |
Show 20 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ch.qos.logback:logback-coreTuxCare:Maven From an advisory covering 3 CVEs |
1.2.11 up to 1.2.11-tuxcare.1 | 1.2.11-tuxcare.1 |
ch.qos.logback:logback-coreTuxCare:Maven From an advisory covering 2 CVEs |
1.2.5 up to 1.2.5-tuxcare.1 | 1.2.5-tuxcare.1 |
logbackDebian:12 |
All versions, plus listed versions 1:1.2.11-31:1.2.11-41:1.2.11-51:1.2.11-61:1.6.3-11:1.6.3-2 |
None known |
logbackDebian:13 |
All versions, plus listed versions 1:1.2.11-61:1.6.3-11:1.6.3-2 |
None known |
logbackDebian:14 |
before 1:1.6.3-1, plus listed versions 1:1.2.11-6 |
1:1.6.3-1 |
ch.qos.logback:logback-coreMaven |
1.4.0 up to 1.5.19, plus listed versions 1.4.11.4.101.4.111.4.121.4.13 Show 28 moreShow less1.4.141.4.21.4.31.4.41.4.51.4.61.4.71.4.81.4.91.5.01.5.11.5.101.5.111.5.121.5.131.5.141.5.151.5.161.5.171.5.181.5.21.5.31.5.41.5.51.5.61.5.71.5.81.5.9 |
1.5.19 |
ch.qos.logback:logback-coreMaven |
before 1.3.16, plus listed versions 0.2.50.30.50.60.7 Show 45 moreShow less0.7.10.80.8.10.90.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.101.0.111.0.121.0.131.0.21.0.31.0.41.0.51.0.6 |
1.3.16 |
ch.qos.logback:logback-coreRed Hat Lightwell:Maven From an advisory covering 7 CVEs |
before 1.2.11.rhlw-00001, plus listed versions 0.2.50.30.50.60.7 Show 45 moreShow less0.7.10.80.8.10.90.9.10.9.100.9.110.9.120.9.130.9.140.9.150.9.160.9.170.9.180.9.190.9.20.9.200.9.210.9.220.9.230.9.240.9.250.9.260.9.270.9.280.9.290.9.30.9.300.9.40.9.50.9.60.9.70.9.80.9.91.0.01.0.11.0.101.0.111.0.121.0.131.0.21.0.31.0.41.0.51.0.6 |
1.2.11.rhlw-00001 |
io.root.ch.qos.logback:logback-coreRoot:Maven |
before 1.5.18-root.io.1 | 1.5.18-root.io.11.4.11-root.io.51.1.3-root.io.21.1.3-root.io.31.4.11-root.io.61.5.8-root.io.11.5.8-root.io.21.0.12-root.io.11.3.15-root.io.11.2.13-root.io.21.5.19-root.io.1 |
ch.qos.logback:logback-coreRoot:Maven |
before 1.1.3-aikido.3 | 1.1.3-aikido.31.4.11-aikido.61.5.8-aikido.21.0.12-aikido.11.3.15-aikido.11.2.13-aikido.21.5.19-aikido.1 |
logbackopenSUSE:Leap 15.6 |
before 1.2.13-150200.3.13.1 | 1.2.13-150200.3.13.1 |
logbackUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:1.1.3-21:1.1.3-2ubuntu0.1~esm1 |
None known |
logbackUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:1.1.9-41:1.1.9-51:1.2.3-21:1.2.3-2ubuntu1~18.04.11:1.2.3-2ubuntu1~18.04.1+esm1 |
None known |
logbackUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:1.2.3-51:1.2.3-5ubuntu0.1~esm1 |
None known |
logbackUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1:1.2.3-61:1.2.7-11:1.2.8-11:1.2.9-11:1.2.10-11:1.2.10-1ubuntu0.1~esm1 |
None known |
logbackUbuntu:24.04:LTS |
All versions, plus listed versions 1:1.2.11-31:1.2.11-41:1.2.11-5 |
None known |
logbackUbuntu:25.10 |
All versions, plus listed versions 1:1.2.11-6 |
None known |
logbackUbuntu:26.10 |
All versions, plus listed versions 1:1.2.11-6build1 |
None known |
logbackUbuntu:26.04:LTS |
All versions, plus listed versions 1:1.2.11-61:1.2.11-6build1 |
None known |
logbackopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 1.2.13-1.1 | 1.2.13-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-11226 is a high vulnerability (CVSS 7.0) in Qos.ch Sarl Logback-core, published October 1, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. Fixed in ch.qos.logback:logback-core 1.5.19.
References
logback.qos.ch/news.html
nvd.nist.gov/vuln/detail/CVE-2025-11226
github.com/qos-ch/logback/commit/61f6a2544f36b3016e0efd434ee21f19269f1df7
Show 23 moreShow less
security-tracker.debian.org/tracker/CVE-2025-11226
suse.com/support/update/announcement/2025/suse-su-202503456-1
bugzilla.suse.com/1250715
ubuntu.com/security/CVE-2025-11226
cve.org/CVERecord?id=CVE-2025-11226
Left out here: 92 versions. The JSON record has them.