PT-2026-44381 · Logback · Logback

York Shen · CVE-2026-9828 · Published 2026-05-28 · Updated 2026-06-12

Positive Technologies (AI Summary)

CVSS v4.0

2.9

Low

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions logback versions prior to 1.5.33

Description Deserialization of untrusted data in the HardenedObjectInputStream module of logback-core allows for restricted Object Injection. An attacker capable of influencing serialized data sent to the 'SimpleSocketServer' or 'SimpleSSLSocketServer' endpoints can instantiate objects from the java.lang and java.util packages that are not explicitly blocked. This issue represents a bypass of intended security restrictions, although no practical method for remote code execution or significant privilege escalation has been identified.

Recommendations Update to a version later than 1.5.32.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-9828

GHSA-P47F-322F-WHFH

OPENSUSE-SU-2026:11016-1

Affected Products

Logback

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9828.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-9828 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-9828 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11016-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9828 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-9828 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-9828 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-9828 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-9828 · Security Note
• https://osv.dev/vulnerability/GHSA-p47f-322f-whfh · Vendor Advisory
• https://github.com/qos-ch/logback · Note
• https://t.me/cveNotify/165158 · Telegram Post
• https://logback.qos.ch/news.html#1.5.33 · Note
• https://suse.com/security/cve/CVE-2026-9828 · Note