CVE-2026-10532

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.

More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.

Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions.

This issue affects logback: through 1.5.33 inclusive.

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.9.rhlw-00031 with backported fixes for CVE-2024-12798, CVE-2024-12801, CVE-2026-10532, and CVE-2026-19880.

CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.

Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension.

A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

CVE-2024-12801: Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12  on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.

The attacks involves the modification of DOCTYPE declaration in  XML configuration files.

CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects

CVE-2026-19880: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.

This issue affects Logback-classic: from 0.9.14 through 1.6.2.

This patched artifact is a drop-in replacement for ch.qos.logback:logback-core 1.5.9 from Maven Central.

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.16.rhlw-00002 with a backported security fix.

CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects

This patched artifact is a drop-in replacement for ch.qos.logback:logback-core 1.5.16 from Maven Central.

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.16.rhlw-00002 with a backported security fix.

CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects

This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.16 from Maven Central.

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.9.rhlw-00031 with backported fixes for CVE-2024-12798, CVE-2024-12801, CVE-2026-10532, and CVE-2026-19880.

CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.

Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension.

A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

CVE-2024-12801: Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12  on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.

The attacks involves the modification of DOCTYPE declaration in  XML configuration files.

CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects

CVE-2026-19880: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.

This issue affects Logback-classic: from 0.9.14 through 1.6.2.

This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.9 from Maven Central.

Red Hat Lightwell has released ch.qos.logback:logback-core 1.2.11.rhlw-00001 with backported fixes for CVE-2023-6378, CVE-2024-12798, CVE-2024-12801, CVE-2025-11226, CVE-2026-10532, CVE-2026-1225, and CVE-2026-9828.

CVE-2023-6378: Logback "receiver" DOS vulnerability

CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 in Java applications allows attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.

Malicious logback configuration files can allow the attacker to execute arbitrary code using the JaninoEventEvaluator extension.

A successful attack requires the user to have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

CVE-2024-12801: Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12  on the Java platform, allows an attacker to forge requests by compromising logback configuration files in XML.

The attacks involves the modification of DOCTYPE declaration in  XML configuration files.

CVE-2025-11226: ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.

A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must  have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

CVE-2026-10532: Logback deserialization whitelist bypass for Proxy objects

CVE-2026-1225: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.

The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.

CVE-2026-9828: Logback deserialization whitelist bypass for java.lang and java.util

This patched artifact is a drop-in replacement for ch.qos.logback:logback-core 1.2.11 from Maven Central.

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects. Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions. This issue affects logback: through 1.5.33 inclusive.

TuxCare rebuilt org.springframework.data:spring-data-r2dbc to address 1 CVE. Fixed in 1.5.18-tuxcare.2.

TuxCare rebuilt ch.qos.logback:logback-core to address 1 CVE. Fixed in 1.5.18-tuxcare.2.

TuxCare rebuilt ch.qos.logback:logback-core to address 3 CVEs. Fixed in 1.2.11-tuxcare.1.

TuxCare rebuilt ch.qos.logback:logback-core to address 2 CVEs. Fixed in 1.4.14-tuxcare.2.

TuxCare rebuilt ch.qos.logback:logback-core to address 4 CVEs. Fixed in 1.2.12-tuxcare.2.

TuxCare rebuilt ch.qos.logback:logback-core to address 4 CVEs. Fixed in 1.4.11-tuxcare.2.

TuxCare rebuilt ch.qos.logback:logback-core to address 1 CVE. Fixed in 1.5.22-tuxcare.1.

TuxCare rebuilt ch.qos.logback:logback-core to address 2 CVEs. Fixed in 1.2.13-tuxcare.2.

TuxCare rebuilt ch.qos.logback:logback-core to address 3 CVEs. Fixed in 1.1.7-tuxcare.3.

TuxCare rebuilt ch.qos.logback:logback-core to address 1 CVE. Fixed in 1.2.5-tuxcare.3.

TuxCare rebuilt ch.qos.logback:logback-core to address 1 CVE. Fixed in 1.2.3-tuxcare.3.

These are all security issues fixed in the logback-1.5.34-1.1 package on the GA media of openSUSE Tumbleweed.

This update for apache-parent, aqute-bnd, google-gson, logback, maven, maven-artifact-transfer, maven-parent, maven-resolver, methanol, osgi-service-subsystem, slf4j, xmvn fixes the following issues:

apache-parent was updated to 40:

• Breaking changes

  • Replace nicoulaj checksum plugin with maveniverse checksum plugin
  • #586: Use RAT0.18 and remove commons-lang3 configuration for JDK25
  • Property version.maven-surefire was removed in #588, should be replaced by version.maven-surefire-plugin, version.maven-failsafe-plugin or version.maven-surefire-report-plugin

• New features and improvements

  • Fix several version property issues

• Documentation updates

  • Update documentation for push-to-atr profile
  • Restore the common wording on the download page

• Maintenance

  • Add local maven configuration for ATR project name override
  • Remove custom name-template for release-drafter
  • Port the site documentation from APT to Markdown

Update to 39:

• New features and improvements
  • add push-to-atr profile

Update to 38:

• Maintenance
  • Update banner links

Update to 37:

• New features and improvements
  • Disable parallel PUT on release

Update to 36:

• Breaking changes
  • Update minimum maven version to match current stable version (3.6.3 -> 3.9)
  • Introduce javaVersion property for maven.compiler.* configuration
  • Switch JDK >= 9 to only use maven.compiler.release
• New features and improvements
  • Add default specification and implementation for javadoc and source manifest entries
• Documentation updates
  • Clarify how to use Apache Snapshot repository
  • activate Fluido skin's anchorJs
• Maintenance
  • Avoid - WARNING: Use of the three-letter time zone ID ... on JDK 25 for RAT plugin
  • feat: enable prevent branch protection rules

• Port to slf4j 2.x

• Add dependency on osgi-service-subsystem to allow upgrade to osgi-compendium 8.0.0

Update to aqute-bnd 6.4.1

• https://github.com/bndtools/bnd/wiki/Changes-in-6.4.0
• https://github.com/bndtools/bnd/wiki/Changes-in-6.4.1-classic

• Initial packaging of the bnd-maven-plugin distributed as a part of aqute-bnd 3.5.0

• Port to slf4j 2.x

• Add dependency on osgi-service-subsystem to allow upgrade to osgi-compendium 8.0.0

Update to aqute-bnd 6.4.1

• https://github.com/bndtools/bnd/wiki/Changes-in-6.4.0
• https://github.com/bndtools/bnd/wiki/Changes-in-6.4.1-classic

• Initial packaging of aqute-bnd 3.5.0

Upgrade to version 2.14.0

• Support for serializing and deserializing Java records
• Add JsonArray.asList and JsonObject.asMap view methods
• Add Gson.fromJson(..., TypeToken) overloads
• Make Object and JsonElement deserialization iterative rather than recursive
• Add support for reflection access filter
• Put module-info.class into Multi-Release JAR folder
• Add GsonBuilder.disableJdkUnsafe()

• Add BuildRequires on google-errorprone-annotations for compiling and Javadoc generation

• Refactor ant build to support Java 9+ modular compilation of module-info.java

• Rewrite the build system for ant to avoid potential build cycles with upcoming Maven 4

Upgrade to upstream version 1.6.5

• Changes of version 1.6.5

  • Fixed a vulnerability (bsc#1284124, CVE-2026-104721) closely related to CVE-2026-19880 (bsc#1284020). The fix made in version 1.6.3, which strips forward and backward slashes from MDC values, was not sufficient. An MDC value could still contain relative path components such as .., variable references such as /, or characters that are special in file name patterns and email addresses. MDCBasedDiscriminator, used by SiftingAppender, now rejects MDC values instead of stripping characters from them. An MDC value is rejected if it is empty, if it is longer than 64 characters, if it contains the sequence .., or if it…