Description
A vulnerability, which was classified as problematic, was found in spdlog up to 1.15.1. This affects the function scoped_padder in the library include/spdlog/pattern_formatter-inl.h. The manipulation leads to resource consumption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 1.15.2 is able to address this issue. The identifier of the patch is 10320184df1eb4638e253a34b1eb44ce78954094. It is recommended to upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | spdlog | 1.15.0, 1.15.1 | 1.15.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | spdlog | 1:1.15.2+ds-1 | — |
| Debian 13 | spdlog | 1:1.15.2+ds-1 | — |
| Debian 12 | spdlog | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | spdlog | No fix yet | — |
| Ubuntu 22.04 LTS | spdlog | No fix yet | — |
| Ubuntu 20.04 LTS | spdlog | No fix yet | — |
| Ubuntu 18.04 LTS | spdlog | No fix yet | — |
| Ubuntu 16.04 LTS | spdlog | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | spdlog | 1.15.3-2.1 | openSUSE-SU-2025:15297-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | doxygen | 1.9.8-2 | — |
Advisories 1
- openSUSE-SU-2025:15297-1 libspdlog1_15-1.15.3-2.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
References
- VDB-312609 | spdlog pattern_formatter-inl.h scoped_padder resource consumption vdb-entry technical-description
- VDB-312609 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #592999 | spdlog spdlog 1.15.1 (commit 3335c38) Uncontrolled Memory Allocation third-party-advisory
- https://github.com/gabime/spdlog/issues/3360 exploit issue-tracking
- https://github.com/gabime/spdlog/issues/3360#issuecomment-2729579422 issue-tracking
- https://github.com/gabime/spdlog/commit/10320184df1eb4638e253a34b1eb44ce78954094 patch
- https://github.com/gabime/spdlog/releases/tag/v1.15.2 patch