Logback allows an attacker to instantiate classes already present on the class path
ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.
The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | ch.qos.logback:logback-core | < 1.5.25 | 1.5.25 |
References
- CVSS vector
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L- Weakness (CWE)
CWE-20- Platform
- Java / Kotlin (Maven)
- Package
ch.qos.logback:logback-core- Disclosed
- 22.01.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-qqpg-mvqg-649v - CC BY 4.0
Vulnerability history: ch.qos.logback:logback-core
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 10
- First → latest
- 06.2021 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 2
- Medium 3
- Low 4
Disclosures per year
- 2021: 2
- 2022: 0
- 2023: 2
- 2024: 2
- 2025: 1
- 2026: 3
-
Logback allows an attacker to instantiate classes already present on the class path this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.