Logback Security Bulletin: Fixes for Deserialization and Path Handling Vulnerabilities

Vulnerability Overview 1. CVE-2026-10471 - Description: A vulnerability related to the previously disclosed CVE-2026-19880, involving forward and backward slashes in MDC values. - Impact: MDC values may contain special characters found in file paths and email addresses. - Remediation: Fixed in logback 1.6.3. 2. CVE-2026-19880 - Description: Forward and backward slashes in MDC values are mishandled. - Impact: MDC values may contain special characters found in file paths and email addresses. - Remediation: Fixed in logback 1.6.3. 3. CVE-2026-13006 - Description: Multiple vulnerabilities in the processing of conditional configurations, which support conditional expressions. - Impact: May lead to security issues in conditional configuration processing. - Remediation: Fixed in logback 1.5.37. 4. CVE-2026-13006 - Description: ACE (Arbitrary Code Execution) attacks within attributes. - Impact: May lead to security issues in conditional configuration processing. - Remediation: Fixed in logback 1.5.37. 5. CVE-2026-13006 - Description: Unicode character sequences within attributes. - Impact: May lead to security issues in conditional configuration processing. - Remediation: Fixed in logback 1.5.35. 6. CVE-2026-13006 - Description: Security issues in conditional configuration processing. - Impact: May lead to security issues in conditional configuration processing. - Remediation: Fixed in logback 1.5.35. 7. CVE-2026-10532 - Description: Vulnerability in during deserialization. - Impact: May lead to security issues during the deserialization process. - Remediation: Fixed in logback 1.5.34. 8. CVE-2026-9828 - Description: Vulnerability in . - Impact: May lead to security issues during the deserialization process. - Remediation: Fixed in logback 1.5.33. 9. CVE-2026-9828 - Description: Vulnerability in . - Impact: May lead to security issues during the deserialization process. - Remediation: Fixed in logback 1.5.33. Affected Scope logback 1.6.x series: Affected by CVE-2026-10471 and CVE-2026-19880. logback 1.5.x series: Affected by CVE-2026-13006, CVE-2026-10532, and CVE-2026-9828. Remediation Upgrade to the latest version: Users are advised to upgrade to logback 1.6.3 or later to address CVE-2026-10471 and CVE-2026-19880. Upgrade to logback 1.5.37: Users are advised to upgrade to logback 1.5.37 or later to address CVE-2026-13006. Upgrade to logback 1.5.35: Users are advised to upgrade to logback 1.5.35 or later to address CVE-2026-13006. Upgrade to logback 1.5.34: Users are advised to upgrade to logback 1.5.34 or later to address CVE-2026-10532. Upgrade to logback 1.5.33: Users are advised to upgrade to logback 1.5.33 or later to address CVE-2026-9828. Proof of Concept (PoC) Code No specific PoC code or exploitation code was provided in the source material.

Goal Reached Thanks to every supporter — we hit 100%!

Logback Security Bulletin: Fixes for Deserialization and Path Handling Vulnerabilities