Vulnerabilities in pkg:maven/ch.qos.logback/logback-core
PACKAGECVE-2026-10532 is a LOW logback vulnerable to object injection vulnerability (CWE-502: Deserialization of Untrusted Data) affecting Logback core libraries in the Maven ecosystem. The issue involves logback vulnerable to object injection through hardenedobjectinputstream modules. Remediation is available by upgrading affected packages to version 1.5.34.
pkg:maven/ch.qos.logback/logback-core
Vulnerability advisories affecting package pkg:maven/ch.qos.logback/logback-core. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-jhq6-gfmj-v8fx | CVE-2026-10532 | LOW | Logback vulnerable to Object Injection through HardenedObjectInputStream modules |
| GHSA-p47f-322f-whfh | CVE-2026-9828 | LOW | QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability |
| GHSA-qqpg-mvqg-649v | CVE-2026-1225 | LOW | Logback allows an attacker to instantiate classes already present on the class path |
| GHSA-25qh-j22f-pwp8 | CVE-2025-11226 | MODERATE | QOS.CH logback-core is vulnerable to Arbitrary Code Execution through file processing |
| GHSA-6v67-2wr5-gvf4 | CVE-2024-12801 | LOW | QOS.CH logback-core Server-Side Request Forgery vulnerability |
| GHSA-pr98-23f8-jwxv | CVE-2024-12798 | MODERATE | QOS.CH logback-core Expression Language Injection vulnerability |
| GHSA-vmq6-5m68-f53m | CVE-2023-6378 | HIGH | logback serialization vulnerability |
| GHSA-gm62-rw4g-vrc4 | CVE-2023-6481 | HIGH | Logback is vulnerable to an attacker mounting a Denial-Of-Service attack by sending poisoned data |
| GHSA-vmfg-rjjm-rjrj | CVE-2017-5929 | CRITICAL | QOS.ch Logback vulnerable to Deserialization of Untrusted Data |
| GHSA-668q-qrv7-99fm | CVE-2021-42550 | MODERATE | Deserialization of Untrusted Data in logback |
CVE-2026-10532 at a Glance
How to Fix CVE-2026-10532
To remediate this vulnerability, upgrade all affected Logback core dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
<dependency>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-core</artifactId>
<version>1.5.34</version>
</dependency>Run the following command in your project directory to verify that all resolved dependencies use the patched release:
mvn dependency:tree -Dincludes=ch.qos.logbackHow to Check if You Are Affected
To determine whether your Java application is affected by CVE-2026-10532, inspect your build dependencies using the Maven Dependency Plugin:
mvn dependency:tree -Dincludes=ch.qos.logbackAnalyze the terminal output to locate any version of Logback core in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.5.34), your application is affected.
Note: The mvn dependency:tree -Dincludes=ch.qos.logback command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-502: Deserialization of Untrusted Data, where the product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. In Logback core, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-10532 Affected Logback core Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
ch.qos.logback:logback-core
|
Maven |
< 1.5.34
|
1.5.34
|
References
Frequently Asked Questions
What is CVE-2026-10532?
Which Logback core versions are affected?
What version fixes CVE-2026-10532?
Is logback-core affected?
What CWE is associated with CVE-2026-10532?
How can I check Maven dependencies for CVE-2026-10532?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-jhq6-gfmj-v8fx",
"modified" : "2026-07-15T21:52:54Z",
"published" : "2026-06-01T15:30:40Z",
"aliases" : [ "CVE-2026-10532" ],
"summary" : "Logback vulnerable to Object Injection through HardenedObjectInputStream modules",
"details" : "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.\n\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions.\n\n\n\nThis issue affects logback: through 1.5.33 inclusive.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/RE:M/U:Green"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Maven",
"name" : "ch.qos.logback:logback-core"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.5.34"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-10532"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/qos-ch/logback"
}, {
"type" : "WEB",
"url" : "https://github.com/qos-ch/logback/releases/tag/v_1.5.34"
}, {
"type" : "WEB",
"url" : "https://logback.qos.ch/news.html#1.5.34"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-502" ],
"severity" : "LOW",
"github_reviewed" : true,
"github_reviewed_at" : "2026-07-08T20:26:32Z",
"nvd_published_at" : "2026-06-01T13:16:30Z"
}
}