Deserialization of untrusted data in logback logback-core (CWE-502) allows an attacker to instantiate objects from java.lang or java.util packages that are not explicitly blocked in the HardenedObjectInputStream whitelist. This bypasses the intended restriction but, according to the information given, no practical remote code execution or privilege escalation has been demonstrated.

The vulnerability affects QOS.CH Sarl’s logback, specifically logback-core through version 1.5.32 inclusive. All installations of logback-core up to and including 1.5.32 are impacted.

The CVSS score of 2.9 indicates a low severity assessment, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation activity to date. The likely attack vector requires an attacker to influence serialized data sent to either SimpleSocketServer or SimpleSSLSocketServer, implying that the threat depends on the exposure of those endpoints and the ability to send crafted payloads. While the bypass does not yet result in confirmed remote code execution, it may compromise application logic or integrity if exploited with malicious objects.