Vulnerability · Published Jan 22, 2026 · Assigned by NCSC.ch
CVE-2026-1225Malicious logback.xml configuration file allows instantiation of arbitrary classes
Low 1.8
In plain English
A low-severity improper input validation in Logback-core from QOS.CH Sarl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | logback | no fix listed | DEBIAN-CVE-2026-1225 |
| Debian:13 | logback | no fix listed | DEBIAN-CVE-2026-1225 |
| Debian:14 | logback | 1:1.6.3-1 | DEBIAN-CVE-2026-1225 |
| Maven | ch.qos.logback:logback-core | 1.5.25 | GHSA-qqpg-mvqg-649v |
| Ubuntu:24.04:LTS | logback | no fix listed | UBUNTU-CVE-2026-1225 |
| Ubuntu:25.10 | logback | no fix listed | UBUNTU-CVE-2026-1225 |
| Ubuntu:26.04:LTS | logback | no fix listed | UBUNTU-CVE-2026-1225 |
| Ubuntu:26.10 | logback | no fix listed | UBUNTU-CVE-2026-1225 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| QOS.CH Sarl | Logback-core | 0.9.20 – through 1.5.24 |
Weakness: CWE-20 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/S:N/AU:N/RE:M/U:Green