CVE-2026-9828

Vulnerability

The vulnerability resides in logback-core's HardenedObjectInputStream mechanism, which is intended to restrict deserialization. However, when deserializing data received by SimpleSocketServer or SimpleSSLSocketServer, it fails to block classes from java.lang and java.util packages that are not explicitly forbidden. This allows injection of objects from those packages if an attacker can control the serialized input. The issue affects logback versions through 1.5.32 inclusive.

Exploitation

An attacker must have network access to a logback instance running SimpleSocketServer or SimpleSSLSocketServer and be able to supply crafted serialized data. By sending a serialized object that instantiates a class from the java.lang or java.util packages not on the block list, the attacker triggers object instantiation. No authentication or user interaction is required, though the attacker's control over the serialized stream is limited by the HardenedObjectInputStream restrictions.

Impact

A successful exploit allows the attacker to instantiate arbitrary java.lang and java.util objects that are not explicitly blocked. However, due to the heavy restriction imposed by HardenedObjectInputStream, no path to remote code execution or significant privilege escalation has been identified. The issue constitutes a bypass of the intended security restrictions, but the practical impact is limited (Low severity).

Mitigation

The issue is addressed in logback version 1.5.33, as indicated by the release announcement [1]. Users should upgrade to 1.5.33 or later. No workaround is documented in the available references. For end-of-life branches (1.3.x and 1.4.x), no fix is provided.