Which versions of Logback are affected by CVE-2025-11226?

QOS.CH's logback-core logging library, a foundational component across enterprise Java environments, contains a remote code execution vulnerability (CVE-2025-11226) that could enable attackers to…. A patch is available.

How to fix or mitigate CVE-2025-11226?

Within 24 hours: Audit and inventory all Java applications using logback-core (vulnerable through version 1.5.18), document current versions in production, and assess access controls to configuration files. Within 7 days: Deploy patched logback-core version from vendor advisory to all production systems, execute testing in staging environments, and complete rollout. Within 30 days: Verify patch deployment across the entire environment, implement monitoring for configuration file access and modifications, and document any access control improvements made.

Logback CVE-2025-11226

Q: What is the CVSS score of CVE-2025-11226?

CVE-2025-11226 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green. EPSS exploitation probability: 0.1%.

EUVD-2025-32903 HIGH

Improper Input Validation (CWE-20)

2025-10-01 vulnerability@ncsc.ch

GHSA-25qh-j22f-pwp8

RCE Java

7.0

CVSS 4.0 · Vendor: ncsc

Severity by source

Vendor (ncsc) PRIMARY

7.0 HIGH

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green

vuln.today AI

5.7 MEDIUM

Local config or env access required (AV:L, PR:H); Janino+Spring classpath dependency makes it AC:H; full code execution yields C:H/I:H but no inherent availability impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

5.3 MEDIUM

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L

Red Hat

6.4 MEDIUM

qualitative

Primary rating from Vendor (ncsc).

CVSS VectorVendor: ncsc

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 24, 2026 - 09:28 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jun 24, 2026 - 09:28 vuln.today

Analysis Updated

Jun 24, 2026 - 09:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 24, 2026 - 09:22 vuln.today

cvss_changed

Severity Changed

Jun 24, 2026 - 09:22 NVD

MEDIUM HIGH

CVSS changed

Jun 24, 2026 - 09:22 NVD

5.9 (MEDIUM) 7.0 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 18:18 euvd

EUVD-2025-32903

Analysis Generated

Mar 13, 2026 - 18:18 vuln.today

CVE Published

Oct 01, 2025 - 08:15 nvd

MEDIUM 5.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

371 maven packages depend on ch.qos.logback:logback-core (44 direct, 327 indirect)

Ecosystem-wide dependent count for version 1.4.0.

DescriptionCVE.org

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.18 in Java applications, allows an attacker to execute arbitrary code by compromising an existing logback configuration file or by injecting an environment variable before program execution.

A successful attack requires the presence of Janino library and Spring Framework to be present on the user's class path. In addition, the attacker must have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege.

AnalysisAI

Arbitrary code execution in QOS.CH logback-core through 1.5.18 allows attackers with write access to a logback configuration file (or the ability to set environment variables) to execute Java code via the conditional configuration feature when the Janino library and Spring Framework are also on the classpath. No public exploit identified at time of analysis and EPSS is low (0.06%), but the issue is tagged as RCE in widely deployed Java logging infrastructure and a vendor patch is available.

Technical ContextAI

Logback-core is the underlying engine of the widely used Logback Java logging framework. The vulnerability sits in the Joran configurator's conditional element (<if condition='...'>), which evaluates Janino-compiled Java expressions; when Spring is also present, expression evaluation can be expanded into a full code-execution sink. The CWE-20 (Improper Input Validation) root cause is that the condition string was passed to Janino without restricting dangerous constructs such as the 'new' operator, allowing instantiation of arbitrary classes. The upstream commit 61f6a25 (issue #974) introduces a hasNew() guard in IfModelHandler that rejects any condition containing 'new '.

RemediationAI

Vendor-released patch: upgrade logback-core to 1.5.19 (or 1.3.16 on the legacy 1.3.x branch) per the QOS.CH release notes at https://logback.qos.ch/news.html#1.5.19 and the GitHub release at https://github.com/qos-ch/logback/releases/tag/v_1.5.19; SUSE users should apply SUSE-SU-2025:03456. As a compensating control until patching, remove Janino (janino.jar) from the classpath where it is not required - this disables <if> conditional configuration evaluation entirely, which is the trade-off; alternatively, audit and tightly restrict filesystem permissions on logback.xml/logback-test.xml so only the application service account can read them and no non-admin user can write them, and prevent untrusted callers from setting the LOGBACK_CONFIG / logback.configurationFile environment variable or JVM property at process start.