ch.qos.logback:logback-core vulnerabilities (Maven)

10 vulnerabilities.

• ch.qos.logback:logback-core Maven Logback deserialization whitelist bypass for Proxy objects CVE-2026-10532 Fix available 2.9 LowJune 1, 2026
• ch.qos.logback:logback-core Maven Logback deserialization whitelist bypass for java.lang and java.util CVE-2026-9828 Fix available 2.9 LowMay 28, 2026
• ch.qos.logback:logback-core Maven Malicious logback.xml configuration file allows instantiation of arbitrary classes CVE-2026-1225 Fix available 1.8 LowJanuary 22, 2026
• ch.qos.logback:logback-core Maven Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino CVE-2025-11226 Fix available 7.0 HighOctober 1, 2025
• ch.qos.logback:logback-core Maven SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks CVE-2024-12801 Fix available 2.4 LowDecember 19, 2024
• ch.qos.logback:logback-core Maven JaninoEventEvaluator vulnerability CVE-2024-12798 Fix available 5.9 MediumDecember 19, 2024
• ch.qos.logback:logback-core Maven Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix CVE-2023-6481 Fix available 7.1 HighDecember 4, 2023
• ch.qos.logback:logback-core Maven Logback "receiver" DOS vulnerability CVE-2023-6378 Fix available 7.1 HighNovember 29, 2023
• ch.qos.logback:logback-core Maven RCE from attacker with configuration edit priviledges through JNDI lookup CVE-2021-42550 Fix available 6.6 MediumDecember 16, 2021
• ch.qos.logback:logback-core Maven QOS.ch Logback vulnerable to Deserialization of Untrusted Data CVE-2017-5929 Fix available 9.8 CriticalMarch 13, 2017