Logback "receiver" DOS vulnerability
Priority LOW 35CWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 4 fixed, 15 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.
Summary
A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.009 59th percentileScored 2026-11-07
Fix Partial logback (QOS.CH Sarl): 1.4.12, 1.3.12, 1.2.13ch.qos.logback:logback-classic (Maven): 1.3.12, 1.4.12, 1.2.13+1 more productRed Hat: 4 advisoriesRed Hat: 4 fixed, 15 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| QOS.CH Sarl | logback | — | 1.4.12, 1.3.12, 1.2.13 | Patch available | CNA |
| — | ch.qos.logback:logback-classic (Maven) | 1.3.0 to before 1.3.12 | 1.3.12 | Patch available | GHSA-vmq6-5m68-f53m |
| — | ch.qos.logback:logback-classic (Maven) | 1.4.0 to before 1.4.12 | 1.4.12 | Patch available | GHSA-vmq6-5m68-f53m |
| — | ch.qos.logback:logback-core (Maven) | 1.3.0 to before 1.3.12 | 1.3.12 | Patch available | GHSA-vmq6-5m68-f53m |
| — | ch.qos.logback:logback-core (Maven) | 1.4.0 to before 1.4.12 | 1.4.12 | Patch available | GHSA-vmq6-5m68-f53m |
| — | ch.qos.logback:logback-core (Maven) | before 1.2.13 | 1.2.13 | Patch available | GHSA-vmq6-5m68-f53m |
| — | ch.qos.logback:logback-classic (Maven) | before 1.2.13 | 1.2.13 | Patch available | GHSA-vmq6-5m68-f53m |
- logback VendorQOS.CH Sarl Affected — Fixed in 1.4.12, 1.3.12, 1.2.13 Patch available CNA
- ch.qos.logback:logback-classic (Maven) Vendor— Affected 1.3.0 to before 1.3.12 Fixed in 1.3.12 Patch available GHSA-vmq6-5m68-f53m
- ch.qos.logback:logback-classic (Maven) Vendor— Affected 1.4.0 to before 1.4.12 Fixed in 1.4.12 Patch available GHSA-vmq6-5m68-f53m
- ch.qos.logback:logback-core (Maven) Vendor— Affected 1.3.0 to before 1.3.12 Fixed in 1.3.12 Patch available GHSA-vmq6-5m68-f53m
- ch.qos.logback:logback-core (Maven) Vendor— Affected 1.4.0 to before 1.4.12 Fixed in 1.4.12 Patch available GHSA-vmq6-5m68-f53m
- ch.qos.logback:logback-core (Maven) Vendor— Affected before 1.2.13 Fixed in 1.2.13 Patch available GHSA-vmq6-5m68-f53m
- ch.qos.logback:logback-classic (Maven) Vendor— Affected before 1.2.13 Fixed in 1.2.13 Patch available GHSA-vmq6-5m68-f53m
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:qos:logback:*:*:*:*:*:*:*:* | 1.2.0 to before 1.2.13; 1.3.0 to before 1.3.12; 1.4.0 to before 1.4.12 | Vulnerable | Qos |
- cpe:2.3:a:qos:logback:*:*:*:*:*:*:*:* Versions 1.2.0 to before 1.2.13; 1.3.0 to before 1.3.12; 1.4.0 to before 1.4.12 Vulnerable ·Qos
Remediation
- Fix · CNA logback (QOS.CH Sarl) Fixed in 1.4.12, 1.3.12, 1.2.13
- Fix · GHSA-vmq6-5m68-f53m ch.qos.logback:logback-classic (Maven) Fixed in 1.3.12 Advisory →
- Fix · GHSA-vmq6-5m68-f53m ch.qos.logback:logback-classic (Maven) Fixed in 1.4.12 Advisory →
- Fix · GHSA-vmq6-5m68-f53m ch.qos.logback:logback-core (Maven) Fixed in 1.3.12 Advisory →
- Fix · GHSA-vmq6-5m68-f53m ch.qos.logback:logback-core (Maven) Fixed in 1.4.12 Advisory →
- Fix · GHSA-vmq6-5m68-f53m ch.qos.logback:logback-core (Maven) Fixed in 1.2.13 Advisory →
- Fix · GHSA-vmq6-5m68-f53m ch.qos.logback:logback-classic (Maven) Fixed in 1.2.13 Advisory →
Red Hat 4 advisories
- RHSA-2024:4631 Released 2024-07-18 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.15.0 release
- Red Hat OpenShift Dev Spaces 3 devspaces/configbump-rhel8, devspaces/dashboard-rhel8, devspaces/devspaces-rhel8-operator +4
- RHSA-2024:3354 Released 2024-05-23 · Red Hat rating ImportantRed Hat Fuse 7.13.0 release and security update
- Red Hat Fuse 7.13.0
- RHSA-2024:2945 Released 2024-05-21 · Red Hat rating ImportantRed Hat AMQ Broker 7.12.0 release and security update
- Red Hat AMQ Broker 7
Show 1 more Red Hat advisories
- RHSA-2024:0793 Released 2024-02-12 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 4.0.3 release security update
- RHINT Camel-Springboot 4.0.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Applications 7 | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix planned: Will not fix |
| Red Hat build of Debezium 2 | Affected | No fix planned: Will not fix |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet |
| streams for Apache Kafka | Affected | No fix yet |
| RHINT Camel-Springboot 4.0.3 | Fixed | RHSA-2024:0793 |
| Red Hat AMQ Broker 7 | Fixed | RHSA-2024:2945 |
| Red Hat Fuse 7.13.0 | Fixed | RHSA-2024:3354 |
| Red Hat OpenShift Dev Spaces 3 | Fixed | RHSA-2024:4631 |
Not affected: 10 products
- A-MQ Clients 2
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Runtimes
- Red Hat Build of Keycloak
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Web Server 6
- Red Hat OpenShift Dev Spaces 3
- Red Hat build of Quarkus
- Red Hat support for Spring Boot
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6378
- 2026-10-03 Alias added: GHSA-vmq6-5m68-f53m
References
Other 9
- https://logback.qos.ch/news.html#1.3.12
- https://github.com/qos-ch/logback/issues/745#issuecomment-1836227158
- https://github.com/qos-ch/logback/commit/9c782b45be4abdafb7e17481e24e7354c2acd1eb
- https://github.com/qos-ch/logback/commit/b8eac23a9de9e05fb6d51160b3f46acd91af9731
- https://github.com/qos-ch/logback/commit/bb095154be011267b64e37a1d401546e7cc2b7c3
- https://github.com/qos-ch/logback
- https://logback.qos.ch/manual/receivers.html
- https://logback.qos.ch/news.html#1.2.13
- https://security.netapp.com/advisory/ntap-20241129-0012
More QOS.CH Sarl vulnerabilities
- TI-2026-11065 Incomplete protection against CVE-2025-11226 CVSS 4.0HIGH 7.0
- TI-2025-10282 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino CVSS 4.0HIGH 7.0
- TI-2024-11860 JaninoEventEvaluator vulnerability CVSS 4.0MEDIUM 5.9
- TI-2026-66127 Logback: Incomplete protection against CVE-2026-19880 CVSS 4.0MEDIUM 6.3
- TI-2026-16116 Incomplete protection against CVE-2025-11226 CVSS 4.0MEDIUM 6.3
- TI-2026-09059 Logback deserialization whitelist bypass for Proxy objects CVSS 4.0LOW 2.9
Sources
- CVE-2023-6378 · CVE Program
- CVE-2023-6378 · NVD
- FIRST EPSS
- GHSA-vmq6-5m68-f53m · GitHub Advisory Database · CC BY 4.0
- CVE-2023-6378 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences