Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/ch.qos.logback/logback-core@1.4.12
Typemaven
Namespacech.qos.logback
Namelogback-core
Version1.4.12
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version1.5.25
Latest_non_vulnerable_version1.5.25
Affected_by_vulnerabilities
0
url VCID-pnxr-hj9y-yfd9
vulnerability_id VCID-pnxr-hj9y-yfd9
summary 
Logback allows an attacker to instantiate classes already present on the class path
ACE vulnerability in configuration file processing  by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.

The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must  have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1225.json
reference_id
reference_type
scores
0
value 5.0
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-1225.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-1225
reference_id
reference_type
scores
0
value 0.00012
scoring_system epss
scoring_elements 0.01679
published_at 2026-04-13T12:55:00Z
1
value 0.00012
scoring_system epss
scoring_elements 0.01689
published_at 2026-04-11T12:55:00Z
2
value 0.00012
scoring_system epss
scoring_elements 0.01704
published_at 2026-04-09T12:55:00Z
3
value 0.00012
scoring_system epss
scoring_elements 0.01697
published_at 2026-04-08T12:55:00Z
4
value 0.00012
scoring_system epss
scoring_elements 0.01694
published_at 2026-04-07T12:55:00Z
5
value 0.00012
scoring_system epss
scoring_elements 0.01695
published_at 2026-04-04T12:55:00Z
6
value 0.00012
scoring_system epss
scoring_elements 0.01687
published_at 2026-04-02T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-1225
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1225
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1225
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/qos-ch/logback
reference_id
reference_type
scores
0
value 1.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/qos-ch/logback
5
reference_url https://github.com/qos-ch/logback/commit/1f97ae1844b1be8486e4e9cade98d7123d3eded5
reference_id
reference_type
scores
0
value 1.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/qos-ch/logback/commit/1f97ae1844b1be8486e4e9cade98d7123d3eded5
6
reference_url https://github.com/qos-ch/logback/issues/997
reference_id
reference_type
scores
0
value 1.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
1
value LOW
scoring_system generic_textual
scoring_elements
url https://github.com/qos-ch/logback/issues/997
7
reference_url https://logback.qos.ch/news.html#1.5.25
reference_id
reference_type
scores
0
value 1.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/S:N/AU:N/RE:M/U:Green
1
value 1.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
2
value LOW
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-22T14:14:09Z/
url https://logback.qos.ch/news.html#1.5.25
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-1225
reference_id
reference_type
scores
0
value 1.8
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
1
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-1225
9
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126748
reference_id 1126748
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1126748
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2431998
reference_id 2431998
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2431998
11
reference_url https://github.com/advisories/GHSA-qqpg-mvqg-649v
reference_id GHSA-qqpg-mvqg-649v
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qqpg-mvqg-649v
fixed_packages
0
url pkg:maven/ch.qos.logback/logback-core@1.5.25
purl pkg:maven/ch.qos.logback/logback-core@1.5.25
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/ch.qos.logback/logback-core@1.5.25
aliases CVE-2026-1225, GHSA-qqpg-mvqg-649v
risk_score 2.2
exploitability 0.5
weighted_severity 4.5
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-pnxr-hj9y-yfd9
Fixing_vulnerabilities
0
url VCID-kfd6-e5jj-fkht
vulnerability_id VCID-kfd6-e5jj-fkht
summary 
logback serialization vulnerability
A serialization vulnerability in logback receiver component part of logback allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

This is only exploitable if logback receiver component is deployed. See https://logback.qos.ch/manual/receivers.html
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-6378.json
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-6378.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-6378
reference_id
reference_type
scores
0
value 0.00613
scoring_system epss
scoring_elements 0.69871
published_at 2026-04-16T12:55:00Z
1
value 0.00613
scoring_system epss
scoring_elements 0.69829
published_at 2026-04-13T12:55:00Z
2
value 0.00613
scoring_system epss
scoring_elements 0.69844
published_at 2026-04-12T12:55:00Z
3
value 0.00613
scoring_system epss
scoring_elements 0.69858
published_at 2026-04-11T12:55:00Z
4
value 0.00613
scoring_system epss
scoring_elements 0.69835
published_at 2026-04-09T12:55:00Z
5
value 0.00613
scoring_system epss
scoring_elements 0.6982
published_at 2026-04-08T12:55:00Z
6
value 0.00613
scoring_system epss
scoring_elements 0.69772
published_at 2026-04-07T12:55:00Z
7
value 0.00613
scoring_system epss
scoring_elements 0.69796
published_at 2026-04-04T12:55:00Z
8
value 0.00613
scoring_system epss
scoring_elements 0.6978
published_at 2026-04-02T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-6378
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6378
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6378
3
reference_url https://github.com/qos-ch/logback
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/qos-ch/logback
4
reference_url https://github.com/qos-ch/logback/commit/9c782b45be4abdafb7e17481e24e7354c2acd1eb
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/qos-ch/logback/commit/9c782b45be4abdafb7e17481e24e7354c2acd1eb
5
reference_url https://github.com/qos-ch/logback/commit/b8eac23a9de9e05fb6d51160b3f46acd91af9731
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/qos-ch/logback/commit/b8eac23a9de9e05fb6d51160b3f46acd91af9731
6
reference_url https://github.com/qos-ch/logback/commit/bb095154be011267b64e37a1d401546e7cc2b7c3
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/qos-ch/logback/commit/bb095154be011267b64e37a1d401546e7cc2b7c3
7
reference_url https://github.com/qos-ch/logback/issues/745#issuecomment-1836227158
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/qos-ch/logback/issues/745#issuecomment-1836227158
8
reference_url https://logback.qos.ch/manual/receivers.html
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://logback.qos.ch/manual/receivers.html
9
reference_url https://logback.qos.ch/news.html#1.2.13
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://logback.qos.ch/news.html#1.2.13
10
reference_url https://logback.qos.ch/news.html#1.3.12
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-11T17:51:31Z/
url https://logback.qos.ch/news.html#1.3.12
11
reference_url https://security.netapp.com/advisory/ntap-20241129-0012
reference_id
reference_type
scores
0
value 7.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20241129-0012
12
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057423
reference_id 1057423
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1057423
13
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2252230
reference_id 2252230
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2252230
14
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-6378
reference_id CVE-2023-6378
reference_type
scores
0
value 7.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-6378
15
reference_url https://github.com/advisories/GHSA-vmq6-5m68-f53m
reference_id GHSA-vmq6-5m68-f53m
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vmq6-5m68-f53m
16
reference_url https://access.redhat.com/errata/RHSA-2024:0793
reference_id RHSA-2024:0793
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:0793
17
reference_url https://access.redhat.com/errata/RHSA-2024:4631
reference_id RHSA-2024:4631
reference_type
scores
url https://access.redhat.com/errata/RHSA-2024:4631
18
reference_url https://usn.ubuntu.com/7616-1/
reference_id USN-7616-1
reference_type
scores
url https://usn.ubuntu.com/7616-1/
fixed_packages
0
url pkg:maven/ch.qos.logback/logback-core@1.2.13
purl pkg:maven/ch.qos.logback/logback-core@1.2.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-pnxr-hj9y-yfd9
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/ch.qos.logback/logback-core@1.2.13
1
url pkg:maven/ch.qos.logback/logback-core@1.3.12
purl pkg:maven/ch.qos.logback/logback-core@1.3.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-pnxr-hj9y-yfd9
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/ch.qos.logback/logback-core@1.3.12
2
url pkg:maven/ch.qos.logback/logback-core@1.4.12
purl pkg:maven/ch.qos.logback/logback-core@1.4.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-pnxr-hj9y-yfd9
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/ch.qos.logback/logback-core@1.4.12
aliases CVE-2023-6378, GHSA-vmq6-5m68-f53m
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-kfd6-e5jj-fkht
Risk_score2.2
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/ch.qos.logback/logback-core@1.4.12