Technical impact
The vulnerability lies in logback’s HardenedObjectInputStream, which is designed to tightly restrict the classes that may be deserialized. An attacker who can supply crafted serialized data to the SimpleSocketServer or SimpleSSLSocketServer can create Proxy objects that bypass this whitelist. This flaw is a deserialization weakness (CWE‑502) and, according to the vendor and available evidence, does not currently lead to remote code execution or major privilege escalation, but it does allow malicious objects to be instantiated within the application’s runtime.
Affected Systems
The issue affects QOS.CH Sarl logback logback-core up to and including version 1.5.33; any installation using 1.5.33 or earlier is vulnerable.
Risk and Exploitability
The CVSS score of 2.9 classifies the problem as low risk, and the absence of an EPSS score and of a KEV listing suggest that there are no known widespread exploits. The required conditions for exploitation imply that an attacker must be able to supply arbitrary serialized data to an exposed logback socket, a remote attack vector. While no functional path to remote code execution has been identified, the ability to instantiate Proxy objects may serve as a foothold in more complex attack scenarios.
Github GHSA