Skip to content
OpenAdvisories
Low · 1.8 CVE-2026-1225 EUVD-2026-4130GHSA-qqpg-mvqg-649v

Malicious logback.xml configuration file allows instantiation of arbitrary classes

Published Jan 22, 2026 · Updated Jan 22, 2026 · Assigned by NCSC.ch

Vendor: QOS.CH Sarl Product: Logback-core Package: akhq Package: apache-nifi Package: apache-nifi-registry Package: apache-nifi-registry-toolkit Package: cassandra-4.1 Package: cassandra-5.0 Package: cassandra-reaper Package: ch.qos.logback:logback-core Package: dependency-track Package: dependency-track-bundled Package: keycloak-config-cli Package: keycloak-config-cli-iamguarded-compat Package: kserve-modelmesh Package: logback Package: logback Package: management-api-for-apache-cassandra-5.0 Package: nextflow Package: sonar-scanner-cli Package: sonarqube Package: trino Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Package: zookeeper-3.9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.

The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a
configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.

Affected products

VendorProductAffectedFixed
QOS.CH Sarl Logback-core 0.9.20 – ≤ 1.5.24 1.5.25

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 logback 1:1.6.3-1 —
Debian 13 logback No fix yet —
Debian 12 logback No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 logback No fix yet —
Ubuntu 26.04 LTS logback No fix yet —
Ubuntu 25.10 logback No fix yet —
Ubuntu 24.04 LTS logback No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS logback No fix yet —
Ubuntu Pro 20.04 LTS logback No fix yet —
Ubuntu Pro 18.04 LTS logback No fix yet —
Ubuntu Pro 16.04 LTS logback No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 apache-commons-cli 1.9.0-150200.3.11.1 SUSE-SU-2026:5189-1
SLES 15 SP7 aqute-bnd 6.4.1-150200.3.16.1 SUSE-SU-2026:5189-1
SLES 15 SP7 glassfish-annotation-api 1.3.2-150200.3.6.1 SUSE-SU-2026:5189-1
SLES 15 SP7 google-gson 2.14.0-150200.3.13.2 SUSE-SU-2026:5189-1
SLES 15 SP7 httpcomponents-client 4.5.14-150200.3.14.2 SUSE-SU-2026:5189-1
SLES 15 SP7 httpcomponents-core 4.4.14-150200.3.11.1 SUSE-SU-2026:5189-1
SLES 15 SP7 jline3 3.30.17-150200.5.11.1 SUSE-SU-2026:5189-1
SLES 15 SP7 maven 3.10.0-150200.4.36.1 SUSE-SU-2026:5189-1
SLES 15 SP7 maven-resolver 2.0.24-150200.3.32.3 SUSE-SU-2026:5189-1
SLES 15 SP7 maven-wagon 3.5.3-150200.3.10.1 SUSE-SU-2026:5189-1
SLES 15 SP7 methanol 1.9.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES 15 SP7 osgi-annotation 8.1.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES 15 SP7 osgi-compendium 7.0.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES 15 SP7 osgi-service-subsystem 1.1.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES 15 SP7 slf4j 2.0.20-150200.3.7.1 SUSE-SU-2026:5189-1
SLES 15 SP7 xmvn +3 4.3.0-150200.3.33.1 SUSE-SU-2026:5189-1
SLES 15 SP6 apache-commons-cli 1.9.0-150200.3.11.1 SUSE-SU-2026:5189-1
SLES 15 SP6 aqute-bnd 6.4.1-150200.3.16.1 SUSE-SU-2026:5189-1
SLES 15 SP6 glassfish-annotation-api 1.3.2-150200.3.6.1 SUSE-SU-2026:5189-1
SLES 15 SP6 google-gson 2.14.0-150200.3.13.2 SUSE-SU-2026:5189-1
SLES 15 SP6 httpcomponents-client 4.5.14-150200.3.14.2 SUSE-SU-2026:5189-1
SLES 15 SP6 httpcomponents-core 4.4.14-150200.3.11.1 SUSE-SU-2026:5189-1
SLES 15 SP6 jline3 3.30.17-150200.5.11.1 SUSE-SU-2026:5189-1
SLES 15 SP6 maven 3.10.0-150200.4.36.1 SUSE-SU-2026:5189-1
SLES 15 SP6 maven-resolver 2.0.24-150200.3.32.3 SUSE-SU-2026:5189-1
SLES 15 SP6 maven-wagon 3.5.3-150200.3.10.1 SUSE-SU-2026:5189-1
SLES 15 SP6 methanol 1.9.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES 15 SP6 osgi-annotation 8.1.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES 15 SP6 osgi-compendium 7.0.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES 15 SP6 osgi-service-subsystem 1.1.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES 15 SP6 slf4j 2.0.20-150200.3.7.1 SUSE-SU-2026:5189-1
SLES 15 SP6 xmvn +3 4.3.0-150200.3.33.1 SUSE-SU-2026:5189-1
SLES 15 SP5 apache-commons-cli 1.9.0-150200.3.11.1 SUSE-SU-2026:5189-1
SLES 15 SP5 aqute-bnd 6.4.1-150200.3.16.1 SUSE-SU-2026:5189-1
SLES 15 SP5 glassfish-annotation-api 1.3.2-150200.3.6.1 SUSE-SU-2026:5189-1
SLES 15 SP5 google-gson 2.14.0-150200.3.13.2 SUSE-SU-2026:5189-1
SLES 15 SP5 httpcomponents-client 4.5.14-150200.3.14.2 SUSE-SU-2026:5189-1
SLES 15 SP5 httpcomponents-core 4.4.14-150200.3.11.1 SUSE-SU-2026:5189-1
SLES 15 SP5 jline3 3.30.17-150200.5.11.1 SUSE-SU-2026:5189-1
SLES 15 SP5 maven 3.10.0-150200.4.36.1 SUSE-SU-2026:5189-1
SLES 15 SP5 maven-artifact-transfer 0.13.1-150200.3.15.2 SUSE-SU-2026:5189-1
SLES 15 SP5 maven-resolver 2.0.24-150200.3.32.3 SUSE-SU-2026:5189-1
SLES 15 SP5 maven-wagon 3.5.3-150200.3.10.1 SUSE-SU-2026:5189-1
SLES 15 SP5 methanol 1.9.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES 15 SP5 osgi-annotation 8.1.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES 15 SP5 osgi-compendium 7.0.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES 15 SP5 osgi-service-subsystem 1.1.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES 15 SP5 slf4j 2.0.20-150200.3.7.1 SUSE-SU-2026:5189-1
SLES 15 SP5 xmvn +3 4.3.0-150200.3.33.1 SUSE-SU-2026:5189-1
SLES 15 SP4 apache-commons-cli 1.9.0-150200.3.11.1 SUSE-SU-2026:5189-1
SLES 15 SP4 aqute-bnd 6.4.1-150200.3.16.1 SUSE-SU-2026:5189-1
SLES 15 SP4 glassfish-annotation-api 1.3.2-150200.3.6.1 SUSE-SU-2026:5189-1
SLES 15 SP4 google-gson 2.14.0-150200.3.13.2 SUSE-SU-2026:5189-1
SLES 15 SP4 httpcomponents-client 4.5.14-150200.3.14.2 SUSE-SU-2026:5189-1
SLES 15 SP4 httpcomponents-core 4.4.14-150200.3.11.1 SUSE-SU-2026:5189-1
SLES 15 SP4 jline3 3.30.17-150200.5.11.1 SUSE-SU-2026:5189-1
SLES 15 SP4 maven 3.10.0-150200.4.36.1 SUSE-SU-2026:5189-1
SLES 15 SP4 maven-artifact-transfer 0.13.1-150200.3.15.2 SUSE-SU-2026:5189-1
SLES 15 SP4 maven-resolver 2.0.24-150200.3.32.3 SUSE-SU-2026:5189-1
SLES 15 SP4 maven-wagon 3.5.3-150200.3.10.1 SUSE-SU-2026:5189-1
SLES 15 SP4 methanol 1.9.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES 15 SP4 osgi-annotation 8.1.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES 15 SP4 osgi-compendium 7.0.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES 15 SP4 osgi-service-subsystem 1.1.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES 15 SP4 slf4j 2.0.20-150200.3.7.1 SUSE-SU-2026:5189-1
SLES 15 SP4 xmvn +3 4.3.0-150200.3.33.1 SUSE-SU-2026:5189-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 apache-commons-cli 1.9.0-150200.3.11.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 aqute-bnd 6.4.1-150200.3.16.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 glassfish-annotation-api 1.3.2-150200.3.6.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 google-gson 2.14.0-150200.3.13.2 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 httpcomponents-client 4.5.14-150200.3.14.2 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 httpcomponents-core 4.4.14-150200.3.11.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 jline3 3.30.17-150200.5.11.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 maven 3.10.0-150200.4.36.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 maven-resolver 2.0.24-150200.3.32.3 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 maven-wagon 3.5.3-150200.3.10.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 methanol 1.9.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 osgi-annotation 8.1.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 osgi-compendium 7.0.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 osgi-service-subsystem 1.1.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 slf4j 2.0.20-150200.3.7.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP6 xmvn +3 4.3.0-150200.3.33.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 apache-commons-cli 1.9.0-150200.3.11.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 aqute-bnd 6.4.1-150200.3.16.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 glassfish-annotation-api 1.3.2-150200.3.6.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 google-gson 2.14.0-150200.3.13.2 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 httpcomponents-client 4.5.14-150200.3.14.2 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 httpcomponents-core 4.4.14-150200.3.11.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 jline3 3.30.17-150200.5.11.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 maven 3.10.0-150200.4.36.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 maven-artifact-transfer 0.13.1-150200.3.15.2 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 maven-resolver 2.0.24-150200.3.32.3 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 maven-wagon 3.5.3-150200.3.10.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 methanol 1.9.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 osgi-annotation 8.1.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 osgi-compendium 7.0.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 osgi-service-subsystem 1.1.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 slf4j 2.0.20-150200.3.7.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP5 xmvn +3 4.3.0-150200.3.33.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 apache-commons-cli 1.9.0-150200.3.11.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 aqute-bnd 6.4.1-150200.3.16.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 glassfish-annotation-api 1.3.2-150200.3.6.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 google-gson 2.14.0-150200.3.13.2 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 httpcomponents-client 4.5.14-150200.3.14.2 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 httpcomponents-core 4.4.14-150200.3.11.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 jline3 3.30.17-150200.5.11.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 maven 3.10.0-150200.4.36.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 maven-artifact-transfer 0.13.1-150200.3.15.2 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 maven-resolver 2.0.24-150200.3.32.3 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 maven-wagon 3.5.3-150200.3.10.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 methanol 1.9.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 osgi-annotation 8.1.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 osgi-compendium 7.0.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 osgi-service-subsystem 1.1.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 slf4j 2.0.20-150200.3.7.1 SUSE-SU-2026:5189-1
SLES for SAP 15 SP4 xmvn +3 4.3.0-150200.3.33.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 apache-commons-cli 1.9.0-150200.3.11.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 aqute-bnd 6.4.1-150200.3.16.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 glassfish-annotation-api 1.3.2-150200.3.6.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 google-gson 2.14.0-150200.3.13.2 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 httpcomponents-client 4.5.14-150200.3.14.2 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 httpcomponents-core 4.4.14-150200.3.11.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 jline3 3.30.17-150200.5.11.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 maven 3.10.0-150200.4.36.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 maven-artifact-transfer 0.13.1-150200.3.15.2 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 maven-resolver 2.0.24-150200.3.32.3 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 maven-wagon 3.5.3-150200.3.10.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 methanol 1.9.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 osgi-annotation 8.1.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 osgi-compendium 7.0.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 osgi-service-subsystem 1.1.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 slf4j 2.0.20-150200.3.7.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP5 xmvn +3 4.3.0-150200.3.33.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 apache-commons-cli 1.9.0-150200.3.11.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 aqute-bnd 6.4.1-150200.3.16.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 glassfish-annotation-api 1.3.2-150200.3.6.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 google-gson 2.14.0-150200.3.13.2 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 httpcomponents-client 4.5.14-150200.3.14.2 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 httpcomponents-core 4.4.14-150200.3.11.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 jline3 3.30.17-150200.5.11.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 maven 3.10.0-150200.4.36.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 maven-artifact-transfer 0.13.1-150200.3.15.2 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 maven-resolver 2.0.24-150200.3.32.3 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 maven-wagon 3.5.3-150200.3.10.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 methanol 1.9.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 osgi-annotation 8.1.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 osgi-compendium 7.0.0-150200.3.9.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 osgi-service-subsystem 1.1.0-150200.5.3.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 slf4j 2.0.20-150200.3.7.1 SUSE-SU-2026:5189-1
SLE HPC 15 SP4 xmvn +3 4.3.0-150200.3.33.1 SUSE-SU-2026:5189-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed logback 1.2.13-2.1 openSUSE-SU-2026:10114-1
openSUSE Leap 15.6 logback 1.2.13-150200.3.16.1 SUSE-SU-2026:0361-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.26.0-r7 —
Wolfi rolling apache-nifi 2.7.2-r5 —
Wolfi rolling apache-nifi-registry +1 2.7.2-r3 —
Wolfi rolling cassandra-4.1 No fix yet —
Wolfi rolling cassandra-5.0 5.0.7-r0 —
Wolfi rolling cassandra-reaper 4.2.3-r1 —
Wolfi rolling dependency-track +1 4.14.0-r0 —
Wolfi rolling keycloak-config-cli +1 6.4.1-r7 —
Wolfi rolling kserve-modelmesh 0.12.0-r22 —
Wolfi rolling management-api-for-apache-cassandra-5.0 0.1.113-r0 —
Wolfi rolling nextflow 25.10.4-r1 —
Wolfi rolling sonar-scanner-cli 8.0.1.6346-r2 —
Wolfi rolling sonarqube 26.1.0.118079-r2 —
Wolfi rolling trino +50 479-r3 —
Wolfi rolling zookeeper-3.9 3.9.4-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven ch.qos.logback:logback-core < 1.5.25 1.5.25 GHSA-qqpg-mvqg-649v

Advisories 6

References