CVE-2026-10532: Logback Core Object Injection Vulnerability
Summary
CVE-2026-10532: Logback vulnerable to Object Injection through HardenedObjectInputStream modules. Affects ch.qos.logback:logback-core versions < 1.5.35. Fixed in 1.5.35. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Logback is a popular logging framework for Java applications, providing a robust and flexible logging solution. It is widely used in various applications for its performance and ease of use. The logback-core module is responsible for the core functionalities of the logging framework. However, it has been identified that certain components within this module, specifically the HardenedObjectInputStream, are vulnerable to object injection attacks, which can potentially compromise the integrity of the application.
Vulnerability Detail
The vulnerability arises from the deserialization of untrusted data in the HardenedObjectInputStream modules of logback-core. An attacker who can manipulate serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can exploit this vulnerability to instantiate Proxy objects. Although the deserialization process is heavily restricted, this flaw represents a bypass of the intended security measures. While no significant privilege escalation or remote code execution has been identified, the potential for object injection poses a risk to application security.
How To Fix
Minimum fixed version
1.5.35
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict the input data to the SimpleSocketServer and SimpleSSLSocketServer to prevent untrusted data from being processed. This can be done by implementing strict validation checks on the incoming data before deserialization.
Conclusion
The CVE-2026-10532 vulnerability in the logback-core module poses a risk of object injection through the HardenedObjectInputStream. While the potential for significant exploitation is limited, it is crucial to update to version 1.5.35 or later to mitigate this risk. Implementing validation checks can also serve as a temporary workaround.
See every vulnerability recorded for ch.qos.logback:logback-core →
FAQ
CVE-2026-10532 is a vulnerability in the logback-core module that allows object injection through the HardenedObjectInputStream, potentially compromising application security.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability.
The main risk is object injection, which could allow an attacker to manipulate application behavior. However, significant privilege escalation or remote code execution has not been identified.
Update your pom.xml file to include the following dependency with the patched version: <dependency><groupId>ch.qos.logback</groupId><artifactId>logback-core</artifactId><version>1.5.35</version></dependency>.
Yes, you can implement strict validation checks on the incoming data to the SimpleSocketServer and SimpleSSLSocketServer to prevent untrusted data from being processed.
Related vulnerabilities
Recent vulnerabilities recorded for ch.qos.logback:logback-core.
