Deserialization Vulnerability in Logback Core by QOS.CH Sarl
CVE-2026-9828

2.9LOW

Key Information:

Vendor

Qos.ch Sarl

Status
Logback
Vendor
CVE Published:
28 May 2026

Badges

👾 Exploit Exists

What is CVE-2026-9828?

A deserialization vulnerability in QOS.CH Sarl's Logback Core allows object injection through unauthorized serialized data. While the HardenedObjectInputStream implements significant restrictions, an attacker could exploit this flaw to instantiate objects from certain classes in the java.lang and java.util packages, thereby bypassing security measures. This vulnerability affects versions up to 1.5.32, emphasizing the need for users to review and update their implementations to safeguard against potential threats.

Affected Version(s)

logback 0 <= 1.5.32

logback 1.5.33

References

https://logback.qos.ch/news.html#1.5.33

CVSS V4

Score:
2.9
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

York Shen https://github.com/york-shen
.