- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 10 · 3 high, 2 medium, 4 low
- Registry
- Maven Central
Advisories 10
- CVE-2026-10532Low 2.9
Logback deserialization whitelist bypass for Proxy objects
Affected: fixed in 1.5.34.
- CVE-2026-9828Low 2.9
Logback deserialization whitelist bypass for java.lang and java.util
Affected: fixed in 1.5.33.
- CVE-2026-1225Low 1.8
Malicious logback.xml configuration file allows instantiation of arbitrary classes
Affected: fixed in 1.5.25.
- CVE-2025-11226High 7.0
Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino
Affected: from 1.4.0, fixed in 1.5.19; fixed in 1.3.16.
- CVE-2024-12801Low 2.4
SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks
Affected: from 1.4.0, fixed in 1.5.13; fixed in 1.3.15.
- CVE-2024-12798Medium 5.9
JaninoEventEvaluator vulnerability
Affected: from 1.4.0, fixed in 1.5.13; fixed in 1.3.15.
- CVE-2023-6481High 7.1
Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix
Affected: from 1.4.13, fixed in 1.4.14; from 1.3.13, fixed in 1.3.14; from 1.2.12, fixed in 1.2.13.
- CVE-2023-6378High 7.1
Logback "receiver" DOS vulnerability
Affected: from 1.3.0, fixed in 1.3.12; from 1.4.0, fixed in 1.4.12; fixed in 1.2.13.
- CVE-2021-42550Medium 6.6
RCE from attacker with configuration edit priviledges through JNDI lookup
Affected: fixed in 1.2.9.
- CVE-2017-5929Unrated
QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.
Affected: fixed in 1.2.0.