CVE-2017-5929: QOS.ch Logback Serialization Vulnerability
Summary
CVE-2017-5929: QOS.ch Logback vulnerable to Deserialization of Untrusted Data. Affects ch.qos.logback:logback-classic versions < 1.2.0. Fixed in 1.2.0. How to fix ↓
Also tracked for
- logback · Debian:11
The same CVE-2017-5929 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QOS.ch Logback is an open-source logging framework for Java applications. It provides a flexible and efficient logging solution with various components like SocketServer and ServerSocketReceiver. These components allow logging data to be received over a Java Socket and deserialized into Java objects for further processing. However, versions prior to 1.2.0 are vulnerable to a serialization vulnerability.
Vulnerability Detail
The vulnerability in QOS.ch Logback arises from the lack of validation of deserialized data received over a Java Socket. The RemoteStreamAppenderClient class in logback-classic and the SocketNode classes in logback-classic and logback-access do not properly validate the deserialized data before processing it. This allows an attacker to send malicious, serialized Java objects over the connection, which can result in the execution of arbitrary code when these objects are deserialized. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 1.6.5 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a possible workaround is to disable the affected components that allow deserialization over a Java Socket. By removing or disabling the SocketServer and ServerSocketReceiver components, the attack surface for this vulnerability can be reduced. However, this workaround may impact the functionality of the logging system and should be considered temporary until the packages can be updated.
Conclusion
The QOS.ch Logback serialization vulnerability (CVE-2017-5929) allows an attacker to execute arbitrary code by sending malicious, serialized Java objects over a Java Socket connection. To mitigate this vulnerability, it is recommended to upgrade to version 1.2.0 or later of the logback-classic and logback-core components. Alternatively, disabling the affected components can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ch.qos.logback:logback-classic →
FAQ
QOS.ch Logback is an open-source logging framework for Java applications. It provides a flexible and efficient logging solution with various components.
Versions prior to 1.2.0 of the logback-classic and logback-core components are vulnerable to this serialization vulnerability.
An attacker can exploit this vulnerability by sending malicious, serialized Java objects over the connection to the Socket. When these objects are deserialized, they can execute arbitrary code on the target system.
This vulnerability has a CVSS score of 9.8, indicating its critical severity.
A possible workaround is to disable the affected components that allow deserialization over a Java Socket. However, this workaround may impact the functionality of the logging system and should be considered temporary.
Related vulnerabilities
Recent vulnerabilities recorded for ch.qos.logback:logback-classic.
