CVE catalog

CVE-2026-1225

logback affected and fixed versions

[CVE catalog]

ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.

Severity
Medium · CVSS 6.4CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.16% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence
Original provider fields
{
  "package_releases": [
    {
      "name": "logback",
      "status": "fixed",
      "release": "sid",
      "version": "1:1.6.3-3"
    },
    {
      "name": "logback",
      "status": "fixed",
      "release": "forky",
      "version": "1:1.6.3-3"
    },
    {
      "name": "logback",
      "status": "vulnerable",
      "release": "trixie",
      "version": "1:1.2.11-6"
    },
    {
      "name": "logback",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "1:1.2.11-3"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1126748,
      "name": "logback",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "unimportant",
      "fixed_version": "1:1.6.3-1"
    },
    {
      "bug": 1126748,
      "name": "logback",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "unimportant",
      "fixed_version": "1:1.6.3-1"
    },
    {
      "bug": 1126748,
      "name": "logback",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": ""
    },
    {
      "bug": 1126748,
      "name": "logback",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "logback",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.13-2.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.2.13-2.1",
      "provider_record_id": "OPENSUSE-SU-2026:10114-1"
    },
    {
      "name": "logback",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.13-150200.3.16.1"
            }
          ]
        }
      ],
      "release": "leap 15.6",
      "versions": [],
      "ecosystem": "rpm",
      "fixed_version": "1.2.13-150200.3.16.1",
      "provider_record_id": "SUSE-SU-2026:0361-1"
    }
  ]
}

[Debian bug #1126748]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [liblogback-java]Unknown

    Source package: [logback]

    Details (2)

    • 1:1.2.11-3 · all · bookworm

      Affected

      dsa · logback · debian · bookworm

    • 1:1.2.11-3 · all · bookworm

      Affected

      dsa · logback · debian · bookworm

  • [liblogback-java-doc]Unknown

    Source package: [logback]

    Details (2)

    • 1:1.2.11-3 · all · bookworm

      Affected

      dsa · logback · debian · bookworm

    • 1:1.2.11-3 · all · bookworm

      Affected

      dsa · logback · debian · bookworm

[openSUSE Tumbleweed]

  • [logback]Unknown

    Source package: [logback]

    Details (1)

    • 1.6.0-1.1 · noarch · tumbleweed

      Fixed · Fixed: 1.2.13-2.1

      dsa · logback · opensuse · tumbleweed

  • [logback-access]Unknown

    Source package: [logback]

    Details (1)

    • 1.6.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.2.13-2.1

      Version impact unknown

      dsa · logback · opensuse · tumbleweed

  • [logback-examples]Unknown

    Source package: [logback]

    Details (1)

    • 1.6.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.2.13-2.1

      Version impact unknown

      dsa · logback · opensuse · tumbleweed

  • [logback-javadoc]Unknown

    Source package: [logback]

    Details (1)

    • 1.6.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.2.13-2.1

      Version impact unknown

      dsa · logback · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]