Deserialization Vulnerability in QOS.CH Logback Core
CVE-2026-10532

2.9LOW

Key Information:

Vendor

Qos.ch Sarl

Status
Logback
Vendor
CVE Published:
1 June 2026

Badges

👾 Exploit Exists

What is CVE-2026-10532?

A deserialization of untrusted data flaw exists in the QOS.CH Logback Core, specifically in the HardenedObjectInputStream module. This vulnerability allows for object injection if an attacker can influence the serialized data sent to either the SimpleSocketServer or SimpleSSLSocketServer. While the HardenedObjectInputStream imposes restrictions that mitigate the impact of this vulnerability, it still allows an attacker to instantiate Proxy objects, effectively bypassing intended security measures.

Affected Version(s)

logback 0 <= 1.5.33

logback 1.5.34

References

https://logback.qos.ch/news.html#1.5.34

CVSS V4

Score:
2.9
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

York Shen https://github.com/york-shen
.