logback vulnerabilities (Debian)

12 vulnerabilities.

• logback Debian Logback: Incomplete protection against CVE-2026-19880 CVE-2026-104721 Fix available 6.3 MediumOctober 2, 2026
• logback Debian Incomplete protection against CVE-2025-11226 CVE-2026-19880 Fix available 6.3 MediumAugust 14, 2026
• logback Debian Incomplete protection against CVE-2025-11226 CVE-2026-13006 Fix available 7.0 HighJune 24, 2026
• logback Debian Logback deserialization whitelist bypass for Proxy objects CVE-2026-10532 Fix available 2.9 LowJune 1, 2026
• logback Debian Logback deserialization whitelist bypass for java.lang and java.util CVE-2026-9828 Fix available 2.9 LowMay 28, 2026
• logback Debian Malicious logback.xml configuration file allows instantiation of arbitrary classes CVE-2026-1225 Fix available 1.8 LowJanuary 22, 2026
• logback Debian Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino CVE-2025-11226 Fix available 7.0 HighOctober 1, 2025
• logback Debian SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks CVE-2024-12801 Fix available 2.4 LowDecember 19, 2024
• logback Debian JaninoEventEvaluator vulnerability CVE-2024-12798 Fix available 5.9 MediumDecember 19, 2024
• logback Debian Logback "receiver" DOS vulnerability CVE-2023-6378 Fix available 7.1 HighNovember 29, 2023
• logback Debian RCE from attacker with configuration edit priviledges through JNDI lookup CVE-2021-42550 Fix available 6.6 MediumDecember 16, 2021
• logback Debian QOS.ch Logback vulnerable to Deserialization of Untrusted Data CVE-2017-5929 Fix available 9.8 CriticalMarch 13, 2017