CVE-2023-6378

HIGH

logback 1.4.11 - Denial of Service via Serialization Vulnerability

Title source: llm

Description

A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.

References (2)

Core 2

Core References

Release Notes

https://logback.qos.ch/news.html#1.3.12

Vendor Advisory

https://security.netapp.com/advisory/ntap-20241129-0012/

Scores

CVSS v3 7.1

EPSS 0.0090

EPSS Percentile 55.0%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-502

Status published

Products (3)

ch.qos.logback/logback-classic 1.3.0 - 1.3.12Maven

ch.qos.logback/logback-core 1.3.0 - 1.3.12Maven

qos/logback 1.2.0 - 1.2.13

Published Nov 29, 2023

Tracked Since Feb 18, 2026