Description
org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libslf4j-java | 1.7.25-3 | — |
| Debian 13 | libslf4j-java | 1.7.25-3 | — |
| Debian 12 | libslf4j-java | 1.7.25-3 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | rhvm-appliance | 2:4.2-20180504.0.el7 | RHSA-2018:1525 |
| RHEL 7 | slf4j +2 | 1.7.4-4.el7_4 | RHSA-2018:0592 |
| RHEL 3 | rh-maven35-slf4j +10 | 1.7.25-1.3.el7 | RHSA-2018:0582 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +15 | 1.5.5.010-1.redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-hibernate +5 | 5.1.13-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-infinispan +5 | 8.2.10-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-jboss-ec2-eap +1 | 7.1.2-1.GA_redhat_1.ep7.el6 | RHSA-2018:1249 |
| Red Hat JBoss EAP 7 | eap7-jboss-ejb-client | 4.0.10-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-jboss-jsf-api_2.2_spec | 2.2.13-5.SP2_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-jboss-marshalling +1 | 2.0.4-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +18 | 1.0.4-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-jboss-weld-2.2-api | 2.4.0-3.SP2_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.5.5-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 3.6.14-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-mod_cluster | 1.3.9-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 5.0.3-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-11.SP10_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-slf4j +3 | 1.7.22-3.redhat_2.1.ep7.el6 | RHSA-2018:0628 |
| Red Hat JBoss EAP 7 | eap7-undertow | 1.4.18-5.SP5_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-weld-core +3 | 2.4.7-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.1.2-1.GA_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.1.9-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.0.6-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 7 | eap7-wildfly-web-console-eap | 2.9.16-2.Final_redhat_1.2.ep7.el6 | RHSA-2018:1248, RHSA-2018:1247 |
| Red Hat JBoss EAP 6 | codehaus-jackson +4 | 1.9.9-12.redhat_6.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.25-26.SP24_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | jboss-as-ee +62 | 7.5.20-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | jboss-ec2-eap +1 | 7.5.20-1.Final_redhat_1.ep6.el6 | RHSA-2018:1451 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.43-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | jbossweb | 7.5.28-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | jgroups | 1:3.2.18-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | lucene-solr | 3.6.2-8.redhat_9.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | picketbox | 4.1.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2018:1450, RHSA-2018:1449, RHSA-2018:1448 |
| Red Hat JBoss EAP 6 | slf4j +1 | 1.7.2-14.redhat_4.1.ep6.el5 | RHSA-2018:0627 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | slf4j | 1.7.12-3.3.1 | SUSE-SU-2018:1744-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 8 | slf4j | 1.7.12-3.3.1 | SUSE-SU-2018:1744-1 |
| SUSE OpenStack Cloud 8 | slf4j | 1.7.12-3.3.1 | SUSE-SU-2018:1744-1 |
| SUSE Manager Server 3.1 | slf4j | 1.7.12-3.3.1 | SUSE-SU-2018:1744-1 |
| SUSE Manager Server 3.0 | slf4j | 1.7.12-3.3.1 | SUSE-SU-2018:1744-1 |
| SUSE HPE Helion OpenStack 8 | slf4j | 1.7.12-3.3.1 | SUSE-SU-2018:1744-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | slf4j | 1.7.30-2.5 | openSUSE-SU-2024:11386-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | slf4j +2 | 1.7.4-4.amzn2 | ALAS2-2018-999 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | slf4j +2 | 1.7.4-4.el7_4 | ELSA-2018-0592 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.slf4j:slf4j-ext | < 1.7.26 | 1.7.26 | GHSA-w77p-8cfg-2x43 |
| Maven | org.slf4j:slf4j-ext | >= 1.8.0-alpha0, < 1.8.0-beta4 | 1.8.0-beta4 | GHSA-w77p-8cfg-2x43 |
Advisories 18
- WID-SEC-2023-3225 SLF4J: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Nov 1, 2026
- RHSA-2018:1451 Red Hat Security Advisory: eap6-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1525 Red Hat Security Advisory: rhvm-appliance security and enhancement update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1450 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1448 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1449 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1249 Red Hat Security Advisory: jboss-ec2-eap package for EAP 7.1.2 Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1248 Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.2 on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:1247 Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.2 for RHEL 7 Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:0627 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:0628 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1 security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:0582 Red Hat Security Advisory: rh-maven35-slf4j security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- RHSA-2018:0592 Red Hat Security Advisory: slf4j security update Red Hat Security Advisories (RHSA) · Aug 9, 2026
- openSUSE-SU-2024:11386-1 jcl-over-slf4j-1.7.30-2.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:1744-1 Security update for slf4j SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1660 Oracle Utilities: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 28, 2025
- ALAS2-2018-999 Important: slf4j security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 19, 2018
- ELSA-2018-0592 Important: slf4j security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 26, 2018
References
- RHSA-2018:1448 vendor-advisory
- 1040627 vdb-entry
- RHSA-2018:1449 vendor-advisory
- https://jira.qos.ch/browse/SLF4J-431
- RHSA-2018:1248 vendor-advisory
- RHSA-2018:1251 vendor-advisory
- RHSA-2018:2143 vendor-advisory
- RHSA-2018:1450 vendor-advisory
- RHSA-2018:2669 vendor-advisory
- RHSA-2018:1323 vendor-advisory
- RHSA-2018:2420 vendor-advisory
- RHSA-2018:0630 vendor-advisory
- RHSA-2018:1525 vendor-advisory
- RHSA-2018:1575 vendor-advisory
- RHSA-2018:1451 vendor-advisory
- RHSA-2018:0629 vendor-advisory
- RHSA-2018:0628 vendor-advisory
- RHSA-2018:0582 vendor-advisory
- 103737 vdb-entry
- RHSA-2018:2419 vendor-advisory
- RHSA-2018:1447 vendor-advisory
- RHSA-2018:1247 vendor-advisory
- RHSA-2018:0627 vendor-advisory
- RHSA-2018:2930 vendor-advisory
- RHSA-2018:1249 vendor-advisory
- RHSA-2018:0592 vendor-advisory
- [infra-devnull] 20190321 [GitHub] [tika] dadoonet opened pull request #268: Update slf4j to 1.8.0-beta4 mailing-list
- [infra-devnull] 20190321 [GitHub] [tika] grossws commented on issue #268: Update slf4j to 1.8.0-beta4 mailing-list
- RHSA-2019:2413 vendor-advisory
- RHSA-2019:3140 vendor-advisory
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://jira.qos.ch/browse/SLF4J-430
- https://github.com/qos-ch/slf4j/commit/d2b27fba88e983f921558da27fc29b5f5d269405
- [hadoop-common-dev] 20200824 [jira] [Created] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Adress: CVE-2018-8088) mailing-list
- [hadoop-common-issues] 20200824 [jira] [Created] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Adress: CVE-2018-8088) mailing-list
- [hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Adress: CVE-2018-8088) mailing-list
- [hadoop-common-issues] 20200824 [jira] [Commented] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Adress: CVE-2018-8088) mailing-list
- [hadoop-common-commits] 20200824 [hadoop] branch branch-3.3 updated: HADOOP-17220. Upgrade slf4j to 1.7.30 ( To Address: CVE-2018-8088). Contributed by Brahma Reddy Battula. mailing-list
- [hadoop-common-issues] 20200824 [jira] [Updated] (HADOOP-17220) Upgrade slf4j to 1.7.30 ( To Address: CVE-2018-8088) mailing-list
- [hadoop-common-commits] 20200824 [hadoop] branch trunk updated: HADOOP-17220. Upgrade slf4j to 1.7.30 ( To Address: CVE-2018-8088). Contributed by Brahma Reddy Battula. mailing-list
- [logging-notifications] 20200825 [jira] [Commented] (LOG4J2-2329) Fix dependency in log4j-slf4j-impl to slf4j due to CVE-2018-8088 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2020.html
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list mailing-list
- [pulsar-commits] 20210127 [GitHub] [pulsar] GLouMcK opened a new issue #9347: Security Vulnerabilities - Black Duck Scan mailing-list
- [iotdb-notifications] 20210325 [jira] [Created] (IOTDB-1258) jcl-over-slf4j have Security Vulnerabilities CVE-2018-8088 mailing-list
- [iotdb-reviews] 20210325 [GitHub] [iotdb] wangchao316 opened a new pull request #2906: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 mailing-list
- [iotdb-reviews] 20210327 [GitHub] [iotdb] wangchao316 closed pull request #2906: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 mailing-list
- [iotdb-reviews] 20210327 [GitHub] [iotdb] wangchao316 opened a new pull request #2906: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 mailing-list
- [zookeeper-issues] 20210327 [jira] [Created] (ZOOKEEPER-4264) Apache Zookeeper 3.6.2 - slf4j 1.7.25 has security vulnerability CVE-2018-8088 mailing-list
- [zookeeper-issues] 20210327 [jira] [Updated] (ZOOKEEPER-4264) Apache Zookeeper 3.6.2 - slf4j 1.7.25 has security vulnerability CVE-2018-8088 mailing-list
- [zookeeper-dev] 20210327 [jira] [Created] (ZOOKEEPER-4264) Apache Zookeeper 3.6.2 - slf4j 1.7.25 has security vulnerability CVE-2018-8088 mailing-list
- [zookeeper-issues] 20210328 [jira] [Commented] (ZOOKEEPER-4264) Apache Zookeeper 3.6.2 - slf4j 1.7.25 has security vulnerability CVE-2018-8088 mailing-list
- [iotdb-reviews] 20210328 [GitHub] [iotdb] HTHou merged pull request #2906: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 mailing-list
- [iotdb-commits] 20210328 [iotdb] branch master updated: [IOTDB-1258] jcl-over-slf4j have security vulnerabilities CVE-2018-8088 (#2906) mailing-list
- [flink-dev] 20210720 [jira] [Created] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 mailing-list
- [flink-issues] 20210720 [jira] [Created] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 mailing-list
- [flink-issues] 20210721 [jira] [Commented] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 mailing-list
- [flink-issues] 20210725 [jira] [Commented] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 mailing-list
- [flink-issues] 20210804 [jira] [Closed] (FLINK-23444) Slf4j 1.7.15 has the high-risk vulnerability CVE-2018-8088 mailing-list