CVE-2026-9828 Details
Description
Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from classes in the java.lang and java.util packages that are not explicitly blocked. Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions. This issue affects logback: through 1.5.32 inclusive.
A vulnerability in QOS.CH Logback's logback-core module, specifically in the HardenedObjectInputStream, allows for object injection through deserialization of untrusted data. An attacker can exploit this by influencing serialized data sent to either SimpleSocketServer or SimpleSSLSocketServer. While the HardenedObjectInputStream is designed to restrict deserialization, this vulnerability bypasses those security measures, allowing the instantiation of certain objects from the java.lang and java.util packages that are not explicitly blocked. Although this issue does not currently lead to remote code execution or significant privilege escalation, it still represents a notable security risk. This vulnerability affects Logback versions through 1.5.32 inclusive.
Users are advised to upgrade to Logback version 1.5.33 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://logback.qos.ch/news.html#1.5.33 | [email protected] | AdvisoryRelease NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| QOS.CH logback-core | <= 1.5.32 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | CVE Modified | [email protected] |
| May 28, 2026 | New CVE Received | [email protected] |