Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Logback-core versions 1.3.15 and earlier in the 1.3 line, and 1.4.0 through 1.5.12, are vulnerable through the JaninoEventEvaluator extension. An attacker who can write to a logback configuration file, or set an environment variable that points to a malicious configuration file before the program starts, can execute arbitrary code. Upgrade to logback-core 1.5.13 or 1.3.15.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.9 | Medium | 4.0 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/RE:L/U:Clear | CNA (NCSC.ch) |
- CISA KEV Not listed.
- EPSS 0.0046, the 40th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:17 UTC First seen by agentprime
- 31 Oct 2026, 14:17 UTC Confirmed by OSV