Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix
Priority LOW 34Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 5 fixed, 13 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
Why it matters now
EPSS 0.00682 52nd percentileScored 2026-11-07
Fix Partial logback (QOS.CH Sarl): 1.4.14, 1.3.14, 1.2.13ch.qos.logback:logback-core (Maven): 1.4.14, 1.3.14, 1.2.13Red Hat: 5 advisoriesRed Hat: 5 fixed, 13 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| QOS.CH Sarl | logback | — | 1.4.14, 1.3.14, 1.2.13 | Patch available | CNA |
| — | ch.qos.logback:logback-core (Maven) | 1.4.13 to before 1.4.14 | 1.4.14 | Patch available | GHSA-gm62-rw4g-vrc4 |
| — | ch.qos.logback:logback-core (Maven) | 1.3.13 to before 1.3.14 | 1.3.14 | Patch available | GHSA-gm62-rw4g-vrc4 |
| — | ch.qos.logback:logback-core (Maven) | 1.2.12 to before 1.2.13 | 1.2.13 | Patch available | GHSA-gm62-rw4g-vrc4 |
- logback VendorQOS.CH Sarl Affected — Fixed in 1.4.14, 1.3.14, 1.2.13 Patch available CNA
- ch.qos.logback:logback-core (Maven) Vendor— Affected 1.4.13 to before 1.4.14 Fixed in 1.4.14 Patch available GHSA-gm62-rw4g-vrc4
- ch.qos.logback:logback-core (Maven) Vendor— Affected 1.3.13 to before 1.3.14 Fixed in 1.3.14 Patch available GHSA-gm62-rw4g-vrc4
- ch.qos.logback:logback-core (Maven) Vendor— Affected 1.2.12 to before 1.2.13 Fixed in 1.2.13 Patch available GHSA-gm62-rw4g-vrc4
Remediation
- Fix · CNA logback (QOS.CH Sarl) Fixed in 1.4.14, 1.3.14, 1.2.13
- Fix · GHSA-gm62-rw4g-vrc4 ch.qos.logback:logback-core (Maven) Fixed in 1.4.14 Advisory →
- Fix · GHSA-gm62-rw4g-vrc4 ch.qos.logback:logback-core (Maven) Fixed in 1.3.14 Advisory →
- Fix · GHSA-gm62-rw4g-vrc4 ch.qos.logback:logback-core (Maven) Fixed in 1.2.13 Advisory →
Red Hat 5 advisories
- RHSA-2024:3354 Released 2024-05-23 · Red Hat rating ImportantRed Hat Fuse 7.13.0 release and security update
- Red Hat Fuse 7.13.0
- RHSA-2024:2945 Released 2024-05-21 · Red Hat rating ImportantRed Hat AMQ Broker 7.12.0 release and security update
- Red Hat AMQ Broker 7
- RHSA-2024:1353 Released 2024-03-18 · Red Hat rating ImportantRed Hat Process Automation Manager 7.13.5 security update
- RHPAM 7.13.5 async
Show 2 more Red Hat advisories
- RHSA-2024:0843 Released 2024-02-15 · Red Hat rating CriticalRelease of OpenShift Serverless 1.31.1
- Red Hat OpenShift Serverless 1.31 openshift-serverless-1-tech-preview/eventing-istio-controller-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1-tech-preview/logic-swf-builder-rhel8 +37
- RHSA-2024:0793 Released 2024-02-12 · Red Hat rating ImportantRed Hat Integration Camel for Spring Boot 4.0.3 release security update
- RHINT Camel-Springboot 4.0.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Decision Manager 7 | Affected | No fix yet |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix planned: Out of support scope |
| Red Hat build of Debezium 2 | Affected | No fix planned: Will not fix |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet |
| Red Hat support for Spring Boot | Affected | No fix planned: Out of support scope |
| streams for Apache Kafka | Affected | No fix yet |
| RHINT Camel-Springboot 4.0.3 | Fixed | RHSA-2024:0793 |
| RHPAM 7.13.5 async | Fixed | RHSA-2024:1353 |
| Red Hat AMQ Broker 7 | Fixed | RHSA-2024:2945 |
| Red Hat Fuse 7.13.0 | Fixed | RHSA-2024:3354 |
| Red Hat OpenShift Serverless 1.31 | Fixed | RHSA-2024:0843 |
Not affected: 10 products
- A-MQ Clients 2
- Logging Subsystem for Red Hat OpenShift
- Migration Toolkit for Applications 6
- Migration Toolkit for Applications 7
- Migration Toolkit for Runtimes
- Red Hat Build of Keycloak
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Web Server 6
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6481
- 2026-10-03 Alias added: GHSA-gm62-rw4g-vrc4
References
More QOS.CH Sarl vulnerabilities
- TI-2026-11065 Incomplete protection against CVE-2025-11226 CVSS 4.0HIGH 7.0
- TI-2025-10282 Conditional processing of logback.xml configuration file, in conjuction with Spring Framework and Janino CVSS 4.0HIGH 7.0
- TI-2024-11860 JaninoEventEvaluator vulnerability CVSS 4.0MEDIUM 5.9
- TI-2026-66127 Logback: Incomplete protection against CVE-2026-19880 CVSS 4.0MEDIUM 6.3
- TI-2026-16116 Incomplete protection against CVE-2025-11226 CVSS 4.0MEDIUM 6.3
- TI-2026-09059 Logback deserialization whitelist bypass for Proxy objects CVSS 4.0LOW 2.9
Sources
- CVE-2023-6481 · CVE Program
- CVE-2023-6481 · NVD
- FIRST EPSS
- GHSA-gm62-rw4g-vrc4 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-6481 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences