{"id":"GHSA-vmq6-5m68-f53m","summary":"logback serialization vulnerability","details":"A serialization vulnerability in logback receiver component part of logback allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.\n\nThis is only exploitable if logback receiver component is deployed. See https://logback.qos.ch/manual/receivers.html","aliases":["CVE-2023-6378"],"modified":"2026-07-17T21:14:57.827174967Z","published":"2023-11-29T12:30:16Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2023-11-29T21:33:01Z","nvd_published_at":"2023-11-29T12:15:07Z","cwe_ids":["CWE-502"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6378"},{"type":"WEB","url":"https://github.com/qos-ch/logback/issues/745#issuecomment-1836227158"},{"type":"WEB","url":"https://github.com/qos-ch/logback/commit/9c782b45be4abdafb7e17481e24e7354c2acd1eb"},{"type":"WEB","url":"https://github.com/qos-ch/logback/commit/b8eac23a9de9e05fb6d51160b3f46acd91af9731"},{"type":"WEB","url":"https://github.com/qos-ch/logback/commit/bb095154be011267b64e37a1d401546e7cc2b7c3"},{"type":"PACKAGE","url":"https://github.com/qos-ch/logback"},{"type":"WEB","url":"https://logback.qos.ch/manual/receivers.html"},{"type":"WEB","url":"https://logback.qos.ch/news.html#1.2.13"},{"type":"WEB","url":"https://logback.qos.ch/news.html#1.3.12"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241129-0012"}],"affected":[{"package":{"name":"ch.qos.logback:logback-classic","ecosystem":"Maven","purl":"pkg:maven/ch.qos.logback/logback-classic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.12"}]}],"versions":["1.3.0","1.3.1","1.3.10","1.3.11","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-vmq6-5m68-f53m/GHSA-vmq6-5m68-f53m.json"}},{"package":{"name":"ch.qos.logback:logback-classic","ecosystem":"Maven","purl":"pkg:maven/ch.qos.logback/logback-classic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.12"}]}],"versions":["1.4.0","1.4.1","1.4.10","1.4.11","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-vmq6-5m68-f53m/GHSA-vmq6-5m68-f53m.json"}},{"package":{"name":"ch.qos.logback:logback-core","ecosystem":"Maven","purl":"pkg:maven/ch.qos.logback/logback-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0"},{"fixed":"1.3.12"}]}],"versions":["1.3.0","1.3.1","1.3.10","1.3.11","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.3.7","1.3.8","1.3.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-vmq6-5m68-f53m/GHSA-vmq6-5m68-f53m.json"}},{"package":{"name":"ch.qos.logback:logback-core","ecosystem":"Maven","purl":"pkg:maven/ch.qos.logback/logback-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.12"}]}],"versions":["1.4.0","1.4.1","1.4.10","1.4.11","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-vmq6-5m68-f53m/GHSA-vmq6-5m68-f53m.json"}},{"package":{"name":"ch.qos.logback:logback-core","ecosystem":"Maven","purl":"pkg:maven/ch.qos.logback/logback-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13"}]}],"versions":["0.2.5","0.3","0.5","0.6","0.7","0.7.1","0.8","0.8.1","0.9","0.9.1","0.9.10","0.9.11","0.9.12","0.9.13","0.9.14","0.9.15","0.9.16","0.9.17","0.9.18","0.9.19","0.9.2","0.9.20","0.9.21","0.9.22","0.9.23","0.9.24","0.9.25","0.9.26","0.9.27","0.9.28","0.9.29","0.9.3","0.9.30","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.10","1.1.11","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.10","1.2.11","1.2.12","1.2.2","1.2.3","1.2.4","1.2.4-groovyless","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-vmq6-5m68-f53m/GHSA-vmq6-5m68-f53m.json"}},{"package":{"name":"ch.qos.logback:logback-classic","ecosystem":"Maven","purl":"pkg:maven/ch.qos.logback/logback-classic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.13"}]}],"versions":["0.2.5","0.3","0.5","0.6","0.7","0.7.1","0.8","0.8.1","0.9","0.9.1","0.9.10","0.9.11","0.9.12","0.9.13","0.9.14","0.9.15","0.9.16","0.9.17","0.9.18","0.9.19","0.9.2","0.9.20","0.9.21","0.9.22","0.9.23","0.9.24","0.9.25","0.9.26","0.9.27","0.9.28","0.9.29","0.9.3","0.9.30","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.1","1.0.10","1.0.11","1.0.12","1.0.13","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.0.9","1.1.0","1.1.1","1.1.10","1.1.11","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9","1.2.0","1.2.1","1.2.10","1.2.11","1.2.12","1.2.2","1.2.3","1.2.4","1.2.4-groovyless","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-vmq6-5m68-f53m/GHSA-vmq6-5m68-f53m.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"}]}