CVE-2023-6481
HIGH7.1EPSS 0.22%Logback is vulnerable to an attacker mounting a Denial-Of-Service attack by sending poisoned data
Published: 12/4/2023Modified: 2/4/2026
Description
A serialization vulnerability in logback receiver component part of logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
Affected packages (1)
- Maven/ch.qos.logback:logback-core>= 1.4.13, < 1.4.14
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.1 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
References (6)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-6481
- PATCHhttps://github.com/qos-ch/logback
- WEBhttps://github.com/qos-ch/logback/commit/7018a3609c7bcc9dc7bf5903509901a986e5f578
- WEBhttps://github.com/qos-ch/logback/commit/c612b2fa3caf6eef3c75f1cd5859438451d0fd6f
- WEBhttps://logback.qos.ch/news.html#1.3.12
- WEBhttps://logback.qos.ch/news.html#1.3.14