CVE-2026-10532

Overview

Logback is an open-source Java logging framework designed as a successor to Log4j. Its core module provides logging infrastructure, logback-classic implements the SLF4J API, and logback-access supplies HTTP access logging for servlet containers.

An authorization bypass vulnerability (CVE-2026-10532) has been identified in the HardenedObjectInputStream class of logback-core, which allows attackers who can influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer to instantiate Proxy objects that the deserialization whitelist is meant to block. No practical way to achieve remote code execution or significant privilege escalation has been identified, but the issue bypasses the intended deserialization restrictions.

Per OWASP: Data which is untrusted cannot be trusted to be well formed. Malformed data or unexpected data could be used to abuse application logic, deny service, or execute arbitrary code, when deserialized.

This issue affects Logback versions prior to 1.5.34.

Details

Module Info

• Product: Logback
• Affected packages: ch.qos.logback:logback-core
• Affected versions: <1.5.34
• GitHub repository: https://github.com/qos-ch/logback
• Published packages: https://central.sonatype.com/artifact/ch.qos.logback/logback-core
• Package manager: Maven
• Fixed in:
  • OSS Logback 1.5.34
  • NES for Logback v1.2.15

Vulnerability Info

This Low-severity vulnerability is found in the ch.qos.logback:logback-core package in Logback versions prior to 1.5.34.

HardenedObjectInputStream is the restricted ObjectInputStream that Logback uses to deserialize logging events received over the network, for example by SimpleSocketServer and SimpleSSLSocketServer. It enforces its whitelist by overriding only resolveClass:

@Override
protected Class<?> resolveClass(ObjectStreamClass anObjectStreamClass) throws IOException, ClassNotFoundException {

    String incomingClassName = anObjectStreamClass.getName();

    if (!isWhitelisted(incomingClassName)) {
        throw new InvalidClassException("Unauthorized deserialization attempt", anObjectStreamClass.getName());
    }

    return super.resolveClass(anObjectStreamClass);
}

Java serialization encodes dynamic proxy classes with a separate proxy class descriptor. When ObjectInputStream reads one, it calls resolveProxyClass with the list of interface names instead of resolveClass. HardenedObjectInputStream does not override resolveProxyClass, so the inherited implementation loads the named interfaces and builds a java.lang.reflect.Proxy class for them without consulting isWhitelisted. An attacker who can send serialized data to a listening socket server can therefore have the server instantiate Proxy objects for interfaces that are not on the whitelist. Exploitation requires SimpleSocketServer or SimpleSSLSocketServer to be running and reachable by the attacker, and the remaining restrictions of HardenedObjectInputStream still limit what the injected objects can do.

Mitigation

Logback 1.2.x is End-of-Life and will not receive any updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported version of Logback.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• York Shen (finder)