EUVD-2026-33632
GHSA-jhq6-gfmj-v8fx
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Green
Primary rating from Vendor (NCSC.ch) · only source for this CVE.
CVSS VectorVendor: NCSC.ch
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Green
Lifecycle Timeline
3Blast Radius
ecosystem impact- 6,273 maven packages depend on ch.qos.logback:logback-core (509 direct, 5,764 indirect)
Ecosystem-wide dependent count for version 1.5.34.
DescriptionCVE.org
Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.
More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.
Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions.
This issue affects logback: through 1.5.33 inclusive.
AnalysisAI
Deserialization restriction bypass in QOS.CH Sarl logback-core affects all versions through 1.5.33, allowing unauthenticated network attackers with the ability to influence serialized data to instantiate Java Proxy objects via SimpleSocketServer or SimpleSSLSocketServer. Despite the 'RCE' tag in source intelligence, the vendor explicitly states that no practical path to remote code execution or significant privilege escalation has been identified - this is a security boundary bypass of the HardenedObjectInputStream defense mechanism, not a full compromise vector. A proof-of-concept exists (CVSS E:P), though CVSS 4.0 scores the overall risk at 2.9 due to high attack complexity and prerequisite deployment conditions.
Technical ContextAI
logback is a widely-deployed Java logging framework produced by QOS.CH Sarl, used as the native backend for the SLF4J logging facade. The affected component is HardenedObjectInputStream within logback-core, which was specifically designed as a defense-in-depth measure to restrict Java deserialization attacks by whitelisting permissible classes during object deserialization. The vulnerable attack surfaces are SimpleSocketServer and SimpleSSLSocketServer - socket-based log appender receivers that accept serialized logging events over the network. CWE-502 (Deserialization of Untrusted Data) is the root cause class: the restriction mechanism is insufficiently strict in that an attacker can bypass the allowlist to force instantiation of Java Proxy objects, a known technique for partial deserialization gadget exploitation. The CPE string cpe:2.3:a:qos.ch_sarl:logback:*:*:*:*:*:*:*:* encompasses all logback versions across platforms, from 0 through 1.5.33 inclusive per EUVD-2026-33632.
RemediationAI
Upgrade logback-core to version 1.5.34 or later, strongly indicated by the vendor release notes anchor at https://logback.qos.ch/news.html#1.5.34 - update your Maven or Gradle dependency to 'ch.qos.logback:logback-classic:1.5.34'. If immediate upgrade is not feasible, the primary compensating control is to disable SimpleSocketServer and SimpleSSLSocketServer entirely - these components are not active in default logback configurations and must be explicitly configured; removing their configuration entries from logback.xml eliminates the attack surface without affecting standard file or console logging. If socket-based log aggregation is operationally required, restrict network access to the socket server port (default 4560 for SimpleSocketServer) using firewall rules or network ACLs to trusted log aggregation hosts only, accepting the trade-off that this does not eliminate the underlying vulnerability if those trusted hosts are compromised. Note that patched version 1.5.34 has not been independently verified against a tagged GitHub release; the fix version is inferred from the vendor news page anchor.
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver compon
In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could
A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an
A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today