CVE-2026-10532

Vulnerability

The deserialization of untrusted data vulnerability exists in the HardenedObjectInputStream module of logback-core. Affected versions include all through 1.5.33 inclusive. The issue allows an attacker to instantiate Proxy objects when sending serialized data to SimpleSocketServer or SimpleSSLSocketServer. While deserialization is heavily restricted by HardenedObjectInputStream, this constitutes a bypass of the intended security restrictions [1].

Exploitation

An attacker with network access to SimpleSocketServer or SimpleSSLSocketServer can craft malicious serialized data to instantiate Proxy objects. However, due to the restrictions in HardenedObjectInputStream, no practical method for achieving remote code execution or significant privilege escalation has been identified. The exploitation is limited to object injection under the heavy constraints [1].

Impact

The impact is a bypass of the intended security restrictions of HardenedObjectInputStream. While object injection is possible, the attacker cannot achieve remote code execution or significant privilege escalation. The confidentiality, integrity, and availability impact is minimal, leading to a low severity rating [1].

Mitigation

Update to logback version 1.5.34 or later, which is expected to include a fix for this issue [1]. If updating is not immediately possible, consider restricting network access to SimpleSocketServer and SimpleSSLSocketServer to trusted hosts only.