VulnerableCode Package Details - pkg:maven/ch.qos.logback/logback-core@1.3.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-kfd6-e5jj-fkht Aliases: CVE-2023-6378 GHSA-vmq6-5m68-f53m	logback serialization vulnerability A serialization vulnerability in logback receiver component part of logback allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. This is only exploitable if logback receiver component is deployed. See https://logback.qos.ch/manual/receivers.html	1.3.12 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 1.4.12 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-pnxr-hj9y-yfd9 Aliases: CVE-2026-1225 GHSA-qqpg-mvqg-649v	Logback allows an attacker to instantiate classes already present on the class path ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.	1.5.25 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-kfd6-e5jj-fkht
Aliases:
CVE-2023-6378
GHSA-vmq6-5m68-f53m

logback serialization vulnerability A serialization vulnerability in logback receiver component part of logback allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. This is only exploitable if logback receiver component is deployed. See https://logback.qos.ch/manual/receivers.html

1.3.12
Affected by 1 other vulnerability.

1.4.12
Affected by 1 other vulnerability.

VCID-pnxr-hj9y-yfd9
Aliases:
CVE-2026-1225
GHSA-qqpg-mvqg-649v

Logback allows an attacker to instantiate classes already present on the class path ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.

1.5.25
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-17T00:11:48.757137+00:00	GitLab Importer	Affected by	VCID-pnxr-hj9y-yfd9	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/ch.qos.logback/logback-core/CVE-2026-1225.yml	38.4.0
2026-04-12T01:35:35.817178+00:00	GitLab Importer	Affected by	VCID-pnxr-hj9y-yfd9	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/ch.qos.logback/logback-core/CVE-2026-1225.yml	38.3.0
2026-04-03T01:44:35.622617+00:00	GitLab Importer	Affected by	VCID-pnxr-hj9y-yfd9	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/ch.qos.logback/logback-core/CVE-2026-1225.yml	38.1.0
2026-04-02T17:00:46.343299+00:00	GHSA Importer	Affected by	VCID-kfd6-e5jj-fkht	https://github.com/advisories/GHSA-vmq6-5m68-f53m	38.1.0