Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/ch.qos.logback/logback-core@1.4.12
purl pkg:maven/ch.qos.logback/logback-core@1.4.12
Next non-vulnerable version 1.5.25
Latest non-vulnerable version 1.5.25
Risk 2.2
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-pnxr-hj9y-yfd9
Aliases:
CVE-2026-1225
GHSA-qqpg-mvqg-649v
Logback allows an attacker to instantiate classes already present on the class path ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.
1.5.25
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-kfd6-e5jj-fkht logback serialization vulnerability A serialization vulnerability in logback receiver component part of logback allows an attacker to mount a Denial-Of-Service attack by sending poisoned data. This is only exploitable if logback receiver component is deployed. See https://logback.qos.ch/manual/receivers.html CVE-2023-6378
GHSA-vmq6-5m68-f53m

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-17T00:11:48.857535+00:00 GitLab Importer Affected by VCID-pnxr-hj9y-yfd9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/ch.qos.logback/logback-core/CVE-2026-1225.yml 38.4.0
2026-04-16T22:44:17.843599+00:00 GitLab Importer Fixing VCID-kfd6-e5jj-fkht https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/ch.qos.logback/logback-core/CVE-2023-6378.yml 38.4.0
2026-04-12T01:35:35.921018+00:00 GitLab Importer Affected by VCID-pnxr-hj9y-yfd9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/ch.qos.logback/logback-core/CVE-2026-1225.yml 38.3.0
2026-04-12T00:03:55.009323+00:00 GitLab Importer Fixing VCID-kfd6-e5jj-fkht https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/ch.qos.logback/logback-core/CVE-2023-6378.yml 38.3.0
2026-04-03T01:44:35.749208+00:00 GitLab Importer Affected by VCID-pnxr-hj9y-yfd9 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/ch.qos.logback/logback-core/CVE-2026-1225.yml 38.1.0
2026-04-03T00:08:35.755340+00:00 GitLab Importer Fixing VCID-kfd6-e5jj-fkht https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/ch.qos.logback/logback-core/CVE-2023-6378.yml 38.1.0
2026-04-02T17:00:46.439395+00:00 GHSA Importer Fixing VCID-kfd6-e5jj-fkht https://github.com/advisories/GHSA-vmq6-5m68-f53m 38.1.0
2026-04-01T12:58:47.750550+00:00 GithubOSV Importer Fixing VCID-kfd6-e5jj-fkht https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-vmq6-5m68-f53m/GHSA-vmq6-5m68-f53m.json 38.0.0
2026-04-01T12:52:10.817630+00:00 GitLab Importer Fixing VCID-kfd6-e5jj-fkht https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/ch.qos.logback/logback-core/CVE-2023-6378.yml 38.0.0