{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1225.json" } ], "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "tracking": { "current_release_date": "2026-07-02T21:42:14+00:00", "generator": { "date": "2026-07-02T21:42:14+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.1" } }, "id": "CVE-2026-1225", "initial_release_date": "2026-01-22T09:24:14.634000+00:00", "revision_history": [ { "date": "2026-01-22T09:24:14.634000+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-07-02T20:23:35+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-07-02T21:42:14+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Logging Subsystem for Red Hat OpenShift", "product": { "name": "Logging Subsystem for Red Hat OpenShift", "product_id": "logging_subsystem_for_red_hat_openshift", "product_identification_helper": { "cpe": "cpe:/a:redhat:logging:5" } } } ], "category": "product_family", "name": "Logging Subsystem for Red Hat OpenShift" }, { "branches": [ { "category": "product_name", "name": "OpenShift Serverless", "product": { "name": "OpenShift Serverless", "product_id": "openshift_serverless", "product_identification_helper": { "cpe": "cpe:/a:redhat:serverless:1" } } } ], "category": "product_family", "name": "OpenShift Serverless" }, { "branches": [ { "category": "product_name", "name": "Red Hat AMQ Broker 7", "product": { "name": "Red Hat AMQ Broker 7", "product_id": "red_hat_amq_broker_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:amq_broker:7" } } } ], "category": "product_family", "name": "Red Hat AMQ Broker 7" }, { "branches": [ { "category": "product_name", "name": "Red Hat AMQ Clients", "product": { "name": "Red Hat AMQ Clients", "product_id": "red_hat_amq_clients", "product_identification_helper": { "cpe": "cpe:/a:redhat:amq_clients:2023" } } } ], "category": "product_family", "name": "Red Hat AMQ Clients" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of Apache Camel for Spring Boot 4", "product": { "name": "Red Hat build of Apache Camel for Spring Boot 4", "product_id": "red_hat_build_of_apache_camel_for_spring_boot_4", "product_identification_helper": { "cpe": "cpe:/a:redhat:camel_spring_boot:4" } } } ], "category": "product_family", "name": "Red Hat build of Apache Camel for Spring Boot 4" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of Apache Camel - HawtIO 4", "product": { "name": "Red Hat build of Apache Camel - HawtIO 4", "product_id": "red_hat_build_of_apache_camel_-_hawtio_4", "product_identification_helper": { "cpe": "cpe:/a:redhat:apache_camel_hawtio:4" } } } ], "category": "product_family", "name": "Red Hat build of Apache Camel - HawtIO 4" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of Debezium 2", "product": { "name": "Red Hat build of Debezium 2", "product_id": "red_hat_build_of_debezium_2", "product_identification_helper": { "cpe": "cpe:/a:redhat:debezium:2" } } } ], "category": "product_family", "name": "Red Hat build of Debezium 2" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of Debezium 3", "product": { "name": "Red Hat build of Debezium 3", "product_id": "red_hat_build_of_debezium_3", "product_identification_helper": { "cpe": "cpe:/a:redhat:debezium:3" } } } ], "category": "product_family", "name": "Red Hat build of Debezium 3" }, { "branches": [ { "category": "product_name", "name": "Red Hat build of OptaPlanner 8", "product": { "name": "Red Hat build of OptaPlanner 8", "product_id": "red_hat_build_of_optaplanner_8", "product_identification_helper": { "cpe": "cpe:/a:redhat:optaplanner:::el6" } } } ], "category": "product_family", "name": "Red Hat build of OptaPlanner 8" }, { "branches": [ { "category": "product_name", "name": "Red Hat Data Grid 8", "product": { "name": "Red Hat Data Grid 8", "product_id": "red_hat_data_grid_8", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_data_grid:8" } } } ], "category": "product_family", "name": "Red Hat Data Grid 8" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 10", "product": { "name": "Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:10" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux 10" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 8", "product": { "name": "Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux 8" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 9", "product": { "name": "Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:9" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux 9" }, { "branches": [ { "category": "product_name", "name": "Red Hat Fuse 7", "product": { "name": "Red Hat Fuse 7", "product_id": "red_hat_fuse_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_fuse:7" } } } ], "category": "product_family", "name": "Red Hat Fuse 7" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Enterprise Application Platform 7", "product": { "name": "Red Hat JBoss Enterprise Application Platform 7", "product_id": "red_hat_jboss_enterprise_application_platform_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform 7" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Enterprise Application Platform 8", "product": { "name": "Red Hat JBoss Enterprise Application Platform 8", "product_id": "red_hat_jboss_enterprise_application_platform_8", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform 8" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "product": { "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack", "product_identification_helper": { "cpe": "cpe:/a:redhat:jbosseapxp" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack" }, { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Web Server 6", "product": { "name": "Red Hat JBoss Web Server 6", "product_id": "red_hat_jboss_web_server_6", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6" } } } ], "category": "product_family", "name": "Red Hat JBoss Web Server 6" }, { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Dev Spaces", "product": { "name": "Red Hat OpenShift Dev Spaces", "product_id": "red_hat_openshift_dev_spaces", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_devspaces:3" } } } ], "category": "product_family", "name": "Red Hat OpenShift Dev Spaces" }, { "branches": [ { "category": "product_name", "name": "Red Hat Process Automation 7", "product": { "name": "Red Hat Process Automation 7", "product_id": "red_hat_process_automation_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_bpms_platform:7" } } } ], "category": "product_family", "name": "Red Hat Process Automation 7" }, { "branches": [ { "category": "product_name", "name": "Red Hat Satellite 6", "product": { "name": "Red Hat Satellite 6", "product_id": "red_hat_satellite_6", "product_identification_helper": { "cpe": "cpe:/a:redhat:satellite:6" } } } ], "category": "product_family", "name": "Red Hat Satellite 6" }, { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7", "product": { "name": "Red Hat Single Sign-On 7", "product_id": "red_hat_single_sign-on_7", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On 7" }, { "branches": [ { "category": "product_name", "name": "streams for Apache Kafka 2", "product": { "name": "streams for Apache Kafka 2", "product_id": "streams_for_apache_kafka_2", "product_identification_helper": { "cpe": "cpe:/a:redhat:amq_streams:2" } } } ], "category": "product_family", "name": "streams for Apache Kafka 2" }, { "branches": [ { "category": "product_name", "name": "streams for Apache Kafka 3", "product": { "name": "streams for Apache Kafka 3", "product_id": "streams_for_apache_kafka_3", "product_identification_helper": { "cpe": "cpe:/a:redhat:amq_streams:3" } } } ], "category": "product_family", "name": "streams for Apache Kafka 3" }, { "category": "product_version", "name": "logback-core", "product": { "name": "logback-core", "product_id": "logback-core", "product_identification_helper": { "purl": "pkg:maven/ch.qos.logback/logback-core" } } }, { "category": "product_version", "name": "openshift-serverless-1/kn-ekb-dispatcher-rhel9", "product": { "name": "openshift-serverless-1/kn-ekb-dispatcher-rhel9", "product_id": "openshift-serverless-1/kn-ekb-dispatcher-rhel9", "product_identification_helper": { "purl": "pkg:oci/kn-ekb-dispatcher-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-ekb-dispatcher-rhel9" } } }, { "category": "product_version", "name": "openshift-serverless-1/kn-ekb-receiver-rhel9", "product": { "name": "openshift-serverless-1/kn-ekb-receiver-rhel9", "product_id": "openshift-serverless-1/kn-ekb-receiver-rhel9", "product_identification_helper": { "purl": "pkg:oci/kn-ekb-receiver-rhel9?repository_url=registry.redhat.io/openshift-serverless-1/kn-ekb-receiver-rhel9" } } }, { "category": "product_version", "name": "slf4j.src", "product": { "name": "slf4j.src", "product_id": "slf4j.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j?arch=src" } } }, { "category": "product_version", "name": "jul-to-slf4j", "product": { "name": "jul-to-slf4j", "product_id": "jul-to-slf4j", "product_identification_helper": { "purl": "pkg:rpm/redhat/jul-to-slf4j" } } }, { "category": "product_version", "name": "slf4j-javadoc", "product": { "name": "slf4j-javadoc", "product_id": "slf4j-javadoc", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-javadoc" } } }, { "category": "product_version", "name": "slf4j-manual", "product": { "name": "slf4j-manual", "product_id": "slf4j-manual", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-manual" } } }, { "category": "product_version", "name": "log4j-over-slf4j", "product": { "name": "log4j-over-slf4j", "product_id": "log4j-over-slf4j", "product_identification_helper": { "purl": "pkg:rpm/redhat/log4j-over-slf4j" } } }, { "category": "product_version", "name": "jcl-over-slf4j", "product": { "name": "jcl-over-slf4j", "product_id": "jcl-over-slf4j", "product_identification_helper": { "purl": "pkg:rpm/redhat/jcl-over-slf4j" } } }, { "category": "product_version", "name": "slf4j-sources", "product": { "name": "slf4j-sources", "product_id": "slf4j-sources", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-sources" } } }, { "category": "product_version", "name": "slf4j-migrator", "product": { "name": "slf4j-migrator", "product_id": "slf4j-migrator", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-migrator" } } }, { "category": "product_version", "name": "slf4j-jcl", "product": { "name": "slf4j-jcl", "product_id": "slf4j-jcl", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-jcl" } } }, { "category": "product_version", "name": "slf4j-jdk14", "product": { "name": "slf4j-jdk14", "product_id": "slf4j-jdk14", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-jdk14" } } }, { "category": "product_version", "name": "log4j-slf4j", "product": { "name": "log4j-slf4j", "product_id": "log4j-slf4j", "product_identification_helper": { "purl": "pkg:rpm/redhat/log4j-slf4j?rpmmod=log4j:2" } } }, { "category": "product_version", "name": "log4j-web", "product": { "name": "log4j-web", "product_id": "log4j-web", "product_identification_helper": { "purl": "pkg:rpm/redhat/log4j-web?rpmmod=log4j:2" } } }, { "category": "product_version", "name": "log4j-jcl", "product": { "name": "log4j-jcl", "product_id": "log4j-jcl", "product_identification_helper": { "purl": "pkg:rpm/redhat/log4j-jcl?rpmmod=log4j:2" } } }, { "category": "product_version", "name": "log4j", "product": { "name": "log4j", "product_id": "log4j", "product_identification_helper": { "purl": "pkg:rpm/redhat/log4j?rpmmod=log4j:2" } } }, { "category": "product_version", "name": "slf4j-sources::maven:3.8", "product": { "name": "slf4j-sources (maven:3.8)", "product_id": "slf4j-sources::maven:3.8", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-sources?rpmmod=maven:3.8" } } }, { "category": "product_version", "name": "slf4j.src::maven:3.8", "product": { "name": "slf4j.src (maven:3.8)", "product_id": "slf4j.src::maven:3.8", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j?arch=src&rpmmod=maven:3.8" } } }, { "category": "product_version", "name": "slf4j-javadoc::maven:3.8", "product": { "name": "slf4j-javadoc (maven:3.8)", "product_id": "slf4j-javadoc::maven:3.8", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-javadoc?rpmmod=maven:3.8" } } }, { "category": "product_version", "name": "slf4j-jdk14::maven:3.8", "product": { "name": "slf4j-jdk14 (maven:3.8)", "product_id": "slf4j-jdk14::maven:3.8", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-jdk14?rpmmod=maven:3.8" } } }, { "category": "product_version", "name": "jcl-over-slf4j::maven:3.8", "product": { "name": "jcl-over-slf4j (maven:3.8)", "product_id": "jcl-over-slf4j::maven:3.8", "product_identification_helper": { "purl": "pkg:rpm/redhat/jcl-over-slf4j?rpmmod=maven:3.8" } } }, { "category": "product_version", "name": "jul-to-slf4j::maven:3.8", "product": { "name": "jul-to-slf4j (maven:3.8)", "product_id": "jul-to-slf4j::maven:3.8", "product_identification_helper": { "purl": "pkg:rpm/redhat/jul-to-slf4j?rpmmod=maven:3.8" } } }, { "category": "product_version", "name": "slf4j-log4j12::maven:3.8", "product": { "name": "slf4j-log4j12 (maven:3.8)", "product_id": "slf4j-log4j12::maven:3.8", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-log4j12?rpmmod=maven:3.8" } } }, { "category": "product_version", "name": "slf4j-jcl::maven:3.8", "product": { "name": "slf4j-jcl (maven:3.8)", "product_id": "slf4j-jcl::maven:3.8", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-jcl?rpmmod=maven:3.8" } } }, { "category": "product_version", "name": "slf4j-manual::maven:3.8", "product": { "name": "slf4j-manual (maven:3.8)", "product_id": "slf4j-manual::maven:3.8", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-manual?rpmmod=maven:3.8" } } }, { "category": "product_version", "name": "log4j-over-slf4j::maven:3.8", "product": { "name": "log4j-over-slf4j (maven:3.8)", "product_id": "log4j-over-slf4j::maven:3.8", "product_identification_helper": { "purl": "pkg:rpm/redhat/log4j-over-slf4j?rpmmod=maven:3.8" } } }, { "category": "product_version", "name": "slf4j::maven:3.8", "product": { "name": "slf4j (maven:3.8)", "product_id": "slf4j::maven:3.8", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j?rpmmod=maven:3.8" } } }, { "category": "product_version", "name": "slf4j-ext::maven:3.8", "product": { "name": "slf4j-ext (maven:3.8)", "product_id": "slf4j-ext::maven:3.8", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-ext?rpmmod=maven:3.8" } } }, { "category": "product_version", "name": "log4j.src", "product": { "name": "log4j.src", "product_id": "log4j.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/log4j?arch=src" } } }, { "category": "product_version", "name": "slf4j", "product": { "name": "slf4j", "product_id": "slf4j", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j?rpmmod=maven:3.9" } } }, { "category": "product_version", "name": "devspaces/openvsx-rhel9", "product": { "name": "devspaces/openvsx-rhel9", "product_id": "devspaces/openvsx-rhel9", "product_identification_helper": { "purl": "pkg:oci/openvsx-rhel9?repository_url=registry.redhat.io/devspaces/openvsx-rhel9" } } }, { "category": "product_version", "name": "devspaces/pluginregistry-rhel9", "product": { "name": "devspaces/pluginregistry-rhel9", "product_id": "devspaces/pluginregistry-rhel9", "product_identification_helper": { "purl": "pkg:oci/pluginregistry-rhel9?repository_url=registry.redhat.io/devspaces/pluginregistry-rhel9" } } }, { "category": "product_version", "name": "devspaces/server-rhel9", "product": { "name": "devspaces/server-rhel9", "product_id": "devspaces/server-rhel9", "product_identification_helper": { "purl": "pkg:oci/server-rhel9?repository_url=registry.redhat.io/devspaces/server-rhel9" } } }, { "category": "product_version", "name": "candlepin-selinux", "product": { "name": "candlepin-selinux", "product_id": "candlepin-selinux", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-selinux" } } }, { "category": "product_version", "name": "candlepin.src", "product": { "name": "candlepin.src", "product_id": "candlepin.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin?arch=src" } } }, { "category": "product_version", "name": "candlepin", "product": { "name": "candlepin", "product_id": "candlepin", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin" } } }, { "category": "product_version", "name": "puppetserver", "product": { "name": "puppetserver", "product_id": "puppetserver", "product_identification_helper": { "purl": "pkg:rpm/redhat/puppetserver" } } }, { "category": "product_version", "name": "puppetserver.src", "product": { "name": "puppetserver.src", "product_id": "puppetserver.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/puppetserver?arch=src" } } }, { "category": "product_version", "name": "puppetserver::satellite-capsule:el8", "product": { "name": "puppetserver (satellite-capsule:el8)", "product_id": "puppetserver::satellite-capsule:el8", "product_identification_helper": { "purl": "pkg:rpm/redhat/puppetserver?rpmmod=satellite-capsule:el8" } } }, { "category": "product_version", "name": "puppetserver.src::satellite-capsule:el8", "product": { "name": "puppetserver.src (satellite-capsule:el8)", "product_id": "puppetserver.src::satellite-capsule:el8", "product_identification_helper": { "purl": "pkg:rpm/redhat/puppetserver?arch=src&rpmmod=satellite-capsule:el8" } } }, { "category": "product_version", "name": "candlepin-selinux::satellite:el8", "product": { "name": "candlepin-selinux (satellite:el8)", "product_id": "candlepin-selinux::satellite:el8", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-selinux?rpmmod=satellite:el8" } } }, { "category": "product_version", "name": "candlepin.src::satellite:el8", "product": { "name": "candlepin.src (satellite:el8)", "product_id": "candlepin.src::satellite:el8", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin?arch=src&rpmmod=satellite:el8" } } }, { "category": "product_version", "name": "candlepin::satellite:el8", "product": { "name": "candlepin (satellite:el8)", "product_id": "candlepin::satellite:el8", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin?rpmmod=satellite:el8" } } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Logging Subsystem for Red Hat OpenShift", "product_id": "logging_subsystem_for_red_hat_openshift:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "logging_subsystem_for_red_hat_openshift" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-serverless-1/kn-ekb-dispatcher-rhel9 as a component of OpenShift Serverless", "product_id": "openshift_serverless:openshift-serverless-1/kn-ekb-dispatcher-rhel9" }, "product_reference": "openshift-serverless-1/kn-ekb-dispatcher-rhel9", "relates_to_product_reference": "openshift_serverless" }, { "category": "default_component_of", "full_product_name": { "name": "openshift-serverless-1/kn-ekb-receiver-rhel9 as a component of OpenShift Serverless", "product_id": "openshift_serverless:openshift-serverless-1/kn-ekb-receiver-rhel9" }, "product_reference": "openshift-serverless-1/kn-ekb-receiver-rhel9", "relates_to_product_reference": "openshift_serverless" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat AMQ Broker 7", "product_id": "red_hat_amq_broker_7:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_amq_broker_7" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat AMQ Clients", "product_id": "red_hat_amq_clients:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_amq_clients" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat build of Apache Camel - HawtIO 4", "product_id": "red_hat_build_of_apache_camel_-_hawtio_4:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_build_of_apache_camel_-_hawtio_4" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat build of Apache Camel for Spring Boot 4", "product_id": "red_hat_build_of_apache_camel_for_spring_boot_4:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_build_of_apache_camel_for_spring_boot_4" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat build of Debezium 2", "product_id": "red_hat_build_of_debezium_2:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_build_of_debezium_2" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat build of Debezium 3", "product_id": "red_hat_build_of_debezium_3:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_build_of_debezium_3" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat build of OptaPlanner 8", "product_id": "red_hat_build_of_optaplanner_8:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_build_of_optaplanner_8" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat Data Grid 8", "product_id": "red_hat_data_grid_8:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_data_grid_8" }, { "category": "default_component_of", "full_product_name": { "name": "jcl-over-slf4j as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:jcl-over-slf4j" }, "product_reference": "jcl-over-slf4j", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "jul-to-slf4j as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:jul-to-slf4j" }, "product_reference": "jul-to-slf4j", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "log4j-over-slf4j as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:log4j-over-slf4j" }, "product_reference": "log4j-over-slf4j", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-javadoc as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:slf4j-javadoc" }, "product_reference": "slf4j-javadoc", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-jcl as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:slf4j-jcl" }, "product_reference": "slf4j-jcl", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-jdk14 as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:slf4j-jdk14" }, "product_reference": "slf4j-jdk14", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-manual as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:slf4j-manual" }, "product_reference": "slf4j-manual", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-migrator as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:slf4j-migrator" }, "product_reference": "slf4j-migrator", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-sources as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:slf4j-sources" }, "product_reference": "slf4j-sources", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j.src as a component of Red Hat Enterprise Linux 10", "product_id": "red_hat_enterprise_linux_10:slf4j.src" }, "product_reference": "slf4j.src", "relates_to_product_reference": "red_hat_enterprise_linux_10" }, { "category": "default_component_of", "full_product_name": { "name": "jcl-over-slf4j (maven:3.8) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:jcl-over-slf4j::maven:3.8" }, "product_reference": "jcl-over-slf4j::maven:3.8", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "jul-to-slf4j (maven:3.8) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:jul-to-slf4j::maven:3.8" }, "product_reference": "jul-to-slf4j::maven:3.8", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "log4j as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:log4j" }, "product_reference": "log4j", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "log4j-jcl as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:log4j-jcl" }, "product_reference": "log4j-jcl", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "log4j-over-slf4j (maven:3.8) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:log4j-over-slf4j::maven:3.8" }, "product_reference": "log4j-over-slf4j::maven:3.8", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "log4j-slf4j as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:log4j-slf4j" }, "product_reference": "log4j-slf4j", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "log4j-web as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:log4j-web" }, "product_reference": "log4j-web", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-ext (maven:3.8) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:slf4j-ext::maven:3.8" }, "product_reference": "slf4j-ext::maven:3.8", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-javadoc (maven:3.8) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:slf4j-javadoc::maven:3.8" }, "product_reference": "slf4j-javadoc::maven:3.8", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-jcl (maven:3.8) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:slf4j-jcl::maven:3.8" }, "product_reference": "slf4j-jcl::maven:3.8", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-jdk14 (maven:3.8) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:slf4j-jdk14::maven:3.8" }, "product_reference": "slf4j-jdk14::maven:3.8", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-log4j12 (maven:3.8) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:slf4j-log4j12::maven:3.8" }, "product_reference": "slf4j-log4j12::maven:3.8", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-manual (maven:3.8) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:slf4j-manual::maven:3.8" }, "product_reference": "slf4j-manual::maven:3.8", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-sources (maven:3.8) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:slf4j-sources::maven:3.8" }, "product_reference": "slf4j-sources::maven:3.8", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j.src (maven:3.8) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:slf4j.src::maven:3.8" }, "product_reference": "slf4j.src::maven:3.8", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j (maven:3.8) as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:slf4j::maven:3.8" }, "product_reference": "slf4j::maven:3.8", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "jcl-over-slf4j as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:jcl-over-slf4j" }, "product_reference": "jcl-over-slf4j", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "log4j-jcl as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:log4j-jcl" }, "product_reference": "log4j-jcl", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "log4j-slf4j as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:log4j-slf4j" }, "product_reference": "log4j-slf4j", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "log4j.src as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:log4j.src" }, "product_reference": "log4j.src", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:slf4j" }, "product_reference": "slf4j", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-jdk14 as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:slf4j-jdk14" }, "product_reference": "slf4j-jdk14", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j.src as a component of Red Hat Enterprise Linux 9", "product_id": "red_hat_enterprise_linux_9:slf4j.src" }, "product_reference": "slf4j.src", "relates_to_product_reference": "red_hat_enterprise_linux_9" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat Fuse 7", "product_id": "red_hat_fuse_7:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_fuse_7" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat JBoss Enterprise Application Platform 7", "product_id": "red_hat_jboss_enterprise_application_platform_7:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_7" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat JBoss Enterprise Application Platform 8", "product_id": "red_hat_jboss_enterprise_application_platform_8:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_8" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat JBoss Web Server 6", "product_id": "red_hat_jboss_web_server_6:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_jboss_web_server_6" }, { "category": "default_component_of", "full_product_name": { "name": "devspaces/openvsx-rhel9 as a component of Red Hat OpenShift Dev Spaces", "product_id": "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9" }, "product_reference": "devspaces/openvsx-rhel9", "relates_to_product_reference": "red_hat_openshift_dev_spaces" }, { "category": "default_component_of", "full_product_name": { "name": "devspaces/pluginregistry-rhel9 as a component of Red Hat OpenShift Dev Spaces", "product_id": "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9" }, "product_reference": "devspaces/pluginregistry-rhel9", "relates_to_product_reference": "red_hat_openshift_dev_spaces" }, { "category": "default_component_of", "full_product_name": { "name": "devspaces/server-rhel9 as a component of Red Hat OpenShift Dev Spaces", "product_id": "red_hat_openshift_dev_spaces:devspaces/server-rhel9" }, "product_reference": "devspaces/server-rhel9", "relates_to_product_reference": "red_hat_openshift_dev_spaces" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat Process Automation 7", "product_id": "red_hat_process_automation_7:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_process_automation_7" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin as a component of Red Hat Satellite 6", "product_id": "red_hat_satellite_6:candlepin" }, "product_reference": "candlepin", "relates_to_product_reference": "red_hat_satellite_6" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-selinux as a component of Red Hat Satellite 6", "product_id": "red_hat_satellite_6:candlepin-selinux" }, "product_reference": "candlepin-selinux", "relates_to_product_reference": "red_hat_satellite_6" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-selinux (satellite:el8) as a component of Red Hat Satellite 6", "product_id": "red_hat_satellite_6:candlepin-selinux::satellite:el8" }, "product_reference": "candlepin-selinux::satellite:el8", "relates_to_product_reference": "red_hat_satellite_6" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin.src as a component of Red Hat Satellite 6", "product_id": "red_hat_satellite_6:candlepin.src" }, "product_reference": "candlepin.src", "relates_to_product_reference": "red_hat_satellite_6" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin.src (satellite:el8) as a component of Red Hat Satellite 6", "product_id": "red_hat_satellite_6:candlepin.src::satellite:el8" }, "product_reference": "candlepin.src::satellite:el8", "relates_to_product_reference": "red_hat_satellite_6" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin (satellite:el8) as a component of Red Hat Satellite 6", "product_id": "red_hat_satellite_6:candlepin::satellite:el8" }, "product_reference": "candlepin::satellite:el8", "relates_to_product_reference": "red_hat_satellite_6" }, { "category": "default_component_of", "full_product_name": { "name": "puppetserver as a component of Red Hat Satellite 6", "product_id": "red_hat_satellite_6:puppetserver" }, "product_reference": "puppetserver", "relates_to_product_reference": "red_hat_satellite_6" }, { "category": "default_component_of", "full_product_name": { "name": "puppetserver.src as a component of Red Hat Satellite 6", "product_id": "red_hat_satellite_6:puppetserver.src" }, "product_reference": "puppetserver.src", "relates_to_product_reference": "red_hat_satellite_6" }, { "category": "default_component_of", "full_product_name": { "name": "puppetserver.src (satellite-capsule:el8) as a component of Red Hat Satellite 6", "product_id": "red_hat_satellite_6:puppetserver.src::satellite-capsule:el8" }, "product_reference": "puppetserver.src::satellite-capsule:el8", "relates_to_product_reference": "red_hat_satellite_6" }, { "category": "default_component_of", "full_product_name": { "name": "puppetserver (satellite-capsule:el8) as a component of Red Hat Satellite 6", "product_id": "red_hat_satellite_6:puppetserver::satellite-capsule:el8" }, "product_reference": "puppetserver::satellite-capsule:el8", "relates_to_product_reference": "red_hat_satellite_6" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of Red Hat Single Sign-On 7", "product_id": "red_hat_single_sign-on_7:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "red_hat_single_sign-on_7" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of streams for Apache Kafka 2", "product_id": "streams_for_apache_kafka_2:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "streams_for_apache_kafka_2" }, { "category": "default_component_of", "full_product_name": { "name": "logback-core as a component of streams for Apache Kafka 3", "product_id": "streams_for_apache_kafka_3:logback-core" }, "product_reference": "logback-core", "relates_to_product_reference": "streams_for_apache_kafka_3" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-1225", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2026-01-22T10:01:11.512158+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2431998" } ], "notes": [ { "category": "description", "text": "ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file.", "title": "Vulnerability description" }, { "category": "summary", "text": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "logging_subsystem_for_red_hat_openshift:logback-core", "openshift_serverless:openshift-serverless-1/kn-ekb-dispatcher-rhel9", "openshift_serverless:openshift-serverless-1/kn-ekb-receiver-rhel9", "red_hat_amq_broker_7:logback-core", "red_hat_amq_clients:logback-core", "red_hat_build_of_apache_camel_-_hawtio_4:logback-core", "red_hat_build_of_apache_camel_for_spring_boot_4:logback-core", "red_hat_build_of_debezium_2:logback-core", "red_hat_build_of_debezium_3:logback-core", "red_hat_build_of_optaplanner_8:logback-core", "red_hat_data_grid_8:logback-core", "red_hat_enterprise_linux_10:jcl-over-slf4j", "red_hat_enterprise_linux_10:jul-to-slf4j", "red_hat_enterprise_linux_10:log4j-over-slf4j", "red_hat_enterprise_linux_10:slf4j-javadoc", "red_hat_enterprise_linux_10:slf4j-jcl", "red_hat_enterprise_linux_10:slf4j-jdk14", "red_hat_enterprise_linux_10:slf4j-manual", "red_hat_enterprise_linux_10:slf4j-migrator", "red_hat_enterprise_linux_10:slf4j-sources", "red_hat_enterprise_linux_10:slf4j.src", "red_hat_enterprise_linux_8:jcl-over-slf4j::maven:3.8", "red_hat_enterprise_linux_8:jul-to-slf4j::maven:3.8", "red_hat_enterprise_linux_8:log4j", "red_hat_enterprise_linux_8:log4j-jcl", "red_hat_enterprise_linux_8:log4j-over-slf4j::maven:3.8", "red_hat_enterprise_linux_8:log4j-slf4j", "red_hat_enterprise_linux_8:log4j-web", "red_hat_enterprise_linux_8:slf4j-ext::maven:3.8", "red_hat_enterprise_linux_8:slf4j-javadoc::maven:3.8", "red_hat_enterprise_linux_8:slf4j-jcl::maven:3.8", "red_hat_enterprise_linux_8:slf4j-jdk14::maven:3.8", "red_hat_enterprise_linux_8:slf4j-log4j12::maven:3.8", "red_hat_enterprise_linux_8:slf4j-manual::maven:3.8", "red_hat_enterprise_linux_8:slf4j-sources::maven:3.8", "red_hat_enterprise_linux_8:slf4j.src::maven:3.8", "red_hat_enterprise_linux_8:slf4j::maven:3.8", "red_hat_enterprise_linux_9:jcl-over-slf4j", "red_hat_enterprise_linux_9:log4j-jcl", "red_hat_enterprise_linux_9:log4j-slf4j", "red_hat_enterprise_linux_9:log4j.src", "red_hat_enterprise_linux_9:slf4j", "red_hat_enterprise_linux_9:slf4j-jdk14", "red_hat_enterprise_linux_9:slf4j.src", "red_hat_fuse_7:logback-core", "red_hat_jboss_enterprise_application_platform_7:logback-core", "red_hat_jboss_enterprise_application_platform_8:logback-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:logback-core", "red_hat_jboss_web_server_6:logback-core", "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9", "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9", "red_hat_openshift_dev_spaces:devspaces/server-rhel9", "red_hat_process_automation_7:logback-core", "red_hat_satellite_6:candlepin", "red_hat_satellite_6:candlepin-selinux", "red_hat_satellite_6:candlepin-selinux::satellite:el8", "red_hat_satellite_6:candlepin.src", "red_hat_satellite_6:candlepin.src::satellite:el8", "red_hat_satellite_6:candlepin::satellite:el8", "red_hat_satellite_6:puppetserver", "red_hat_satellite_6:puppetserver.src", "red_hat_satellite_6:puppetserver.src::satellite-capsule:el8", "red_hat_satellite_6:puppetserver::satellite-capsule:el8", "red_hat_single_sign-on_7:logback-core", "streams_for_apache_kafka_2:logback-core", "streams_for_apache_kafka_3:logback-core" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-1225" }, { "category": "external", "summary": "RHBZ#2431998", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431998" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1225", "url": "https://www.cve.org/CVERecord?id=CVE-2026-1225" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1225", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1225" }, { "category": "external", "summary": "https://logback.qos.ch/news.html#1.5.25", "url": "https://logback.qos.ch/news.html#1.5.25" } ], "release_date": "2026-01-22T09:24:14.634000+00:00", "remediations": [ { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "logging_subsystem_for_red_hat_openshift:logback-core", "openshift_serverless:openshift-serverless-1/kn-ekb-dispatcher-rhel9", "openshift_serverless:openshift-serverless-1/kn-ekb-receiver-rhel9", "red_hat_amq_broker_7:logback-core", "red_hat_amq_clients:logback-core", "red_hat_build_of_apache_camel_-_hawtio_4:logback-core", "red_hat_build_of_apache_camel_for_spring_boot_4:logback-core", "red_hat_build_of_debezium_2:logback-core", "red_hat_build_of_debezium_3:logback-core", "red_hat_build_of_optaplanner_8:logback-core", "red_hat_data_grid_8:logback-core", "red_hat_enterprise_linux_10:jcl-over-slf4j", "red_hat_enterprise_linux_10:jul-to-slf4j", "red_hat_enterprise_linux_10:log4j-over-slf4j", "red_hat_enterprise_linux_10:slf4j-javadoc", "red_hat_enterprise_linux_10:slf4j-jcl", "red_hat_enterprise_linux_10:slf4j-jdk14", "red_hat_enterprise_linux_10:slf4j-manual", "red_hat_enterprise_linux_10:slf4j-migrator", "red_hat_enterprise_linux_10:slf4j-sources", "red_hat_enterprise_linux_10:slf4j.src", "red_hat_enterprise_linux_8:jcl-over-slf4j::maven:3.8", "red_hat_enterprise_linux_8:jul-to-slf4j::maven:3.8", "red_hat_enterprise_linux_8:log4j", "red_hat_enterprise_linux_8:log4j-jcl", "red_hat_enterprise_linux_8:log4j-over-slf4j::maven:3.8", "red_hat_enterprise_linux_8:log4j-slf4j", "red_hat_enterprise_linux_8:log4j-web", "red_hat_enterprise_linux_8:slf4j-ext::maven:3.8", "red_hat_enterprise_linux_8:slf4j-javadoc::maven:3.8", "red_hat_enterprise_linux_8:slf4j-jcl::maven:3.8", "red_hat_enterprise_linux_8:slf4j-jdk14::maven:3.8", "red_hat_enterprise_linux_8:slf4j-log4j12::maven:3.8", "red_hat_enterprise_linux_8:slf4j-manual::maven:3.8", "red_hat_enterprise_linux_8:slf4j-sources::maven:3.8", "red_hat_enterprise_linux_8:slf4j.src::maven:3.8", "red_hat_enterprise_linux_8:slf4j::maven:3.8", "red_hat_enterprise_linux_9:jcl-over-slf4j", "red_hat_enterprise_linux_9:log4j-jcl", "red_hat_enterprise_linux_9:log4j-slf4j", "red_hat_enterprise_linux_9:log4j.src", "red_hat_enterprise_linux_9:slf4j", "red_hat_enterprise_linux_9:slf4j-jdk14", "red_hat_enterprise_linux_9:slf4j.src", "red_hat_fuse_7:logback-core", "red_hat_jboss_enterprise_application_platform_7:logback-core", "red_hat_jboss_enterprise_application_platform_8:logback-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:logback-core", "red_hat_jboss_web_server_6:logback-core", "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9", "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9", "red_hat_openshift_dev_spaces:devspaces/server-rhel9", "red_hat_process_automation_7:logback-core", "red_hat_satellite_6:candlepin", "red_hat_satellite_6:candlepin-selinux", "red_hat_satellite_6:candlepin-selinux::satellite:el8", "red_hat_satellite_6:candlepin.src", "red_hat_satellite_6:candlepin.src::satellite:el8", "red_hat_satellite_6:candlepin::satellite:el8", "red_hat_satellite_6:puppetserver", "red_hat_satellite_6:puppetserver.src", "red_hat_satellite_6:puppetserver.src::satellite-capsule:el8", "red_hat_satellite_6:puppetserver::satellite-capsule:el8", "red_hat_single_sign-on_7:logback-core", "streams_for_apache_kafka_2:logback-core", "streams_for_apache_kafka_3:logback-core" ] }, { "category": "no_fix_planned", "details": "Out of support scope", "product_ids": [ "red_hat_enterprise_linux_9:log4j-jcl", "red_hat_enterprise_linux_9:log4j-slf4j", "red_hat_enterprise_linux_9:log4j.src" ] }, { "category": "none_available", "details": "Fix deferred", "product_ids": [ "logging_subsystem_for_red_hat_openshift:logback-core", "openshift_serverless:openshift-serverless-1/kn-ekb-dispatcher-rhel9", "openshift_serverless:openshift-serverless-1/kn-ekb-receiver-rhel9", "red_hat_amq_broker_7:logback-core", "red_hat_amq_clients:logback-core", "red_hat_build_of_apache_camel_-_hawtio_4:logback-core", "red_hat_build_of_apache_camel_for_spring_boot_4:logback-core", "red_hat_build_of_debezium_2:logback-core", "red_hat_build_of_debezium_3:logback-core", "red_hat_build_of_optaplanner_8:logback-core", "red_hat_data_grid_8:logback-core", "red_hat_enterprise_linux_10:jcl-over-slf4j", "red_hat_enterprise_linux_10:jul-to-slf4j", "red_hat_enterprise_linux_10:log4j-over-slf4j", "red_hat_enterprise_linux_10:slf4j-javadoc", "red_hat_enterprise_linux_10:slf4j-jcl", "red_hat_enterprise_linux_10:slf4j-jdk14", "red_hat_enterprise_linux_10:slf4j-manual", "red_hat_enterprise_linux_10:slf4j-migrator", "red_hat_enterprise_linux_10:slf4j-sources", "red_hat_enterprise_linux_10:slf4j.src", "red_hat_enterprise_linux_8:jcl-over-slf4j::maven:3.8", "red_hat_enterprise_linux_8:jul-to-slf4j::maven:3.8", "red_hat_enterprise_linux_8:log4j", "red_hat_enterprise_linux_8:log4j-jcl", "red_hat_enterprise_linux_8:log4j-over-slf4j::maven:3.8", "red_hat_enterprise_linux_8:log4j-slf4j", "red_hat_enterprise_linux_8:log4j-web", "red_hat_enterprise_linux_8:slf4j-ext::maven:3.8", "red_hat_enterprise_linux_8:slf4j-javadoc::maven:3.8", "red_hat_enterprise_linux_8:slf4j-jcl::maven:3.8", "red_hat_enterprise_linux_8:slf4j-jdk14::maven:3.8", "red_hat_enterprise_linux_8:slf4j-log4j12::maven:3.8", "red_hat_enterprise_linux_8:slf4j-manual::maven:3.8", "red_hat_enterprise_linux_8:slf4j-sources::maven:3.8", "red_hat_enterprise_linux_8:slf4j.src::maven:3.8", "red_hat_enterprise_linux_8:slf4j::maven:3.8", "red_hat_enterprise_linux_9:jcl-over-slf4j", "red_hat_enterprise_linux_9:slf4j", "red_hat_enterprise_linux_9:slf4j-jdk14", "red_hat_enterprise_linux_9:slf4j.src", "red_hat_fuse_7:logback-core", "red_hat_jboss_enterprise_application_platform_7:logback-core", "red_hat_jboss_enterprise_application_platform_8:logback-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:logback-core", "red_hat_jboss_web_server_6:logback-core", "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9", "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9", "red_hat_openshift_dev_spaces:devspaces/server-rhel9", "red_hat_process_automation_7:logback-core", "red_hat_satellite_6:candlepin", "red_hat_satellite_6:candlepin-selinux", "red_hat_satellite_6:candlepin-selinux::satellite:el8", "red_hat_satellite_6:candlepin.src", "red_hat_satellite_6:candlepin.src::satellite:el8", "red_hat_satellite_6:candlepin::satellite:el8", "red_hat_satellite_6:puppetserver", "red_hat_satellite_6:puppetserver.src", "red_hat_satellite_6:puppetserver.src::satellite-capsule:el8", "red_hat_satellite_6:puppetserver::satellite-capsule:el8", "red_hat_single_sign-on_7:logback-core", "streams_for_apache_kafka_2:logback-core", "streams_for_apache_kafka_3:logback-core" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L", "version": "3.1" }, "products": [ "logging_subsystem_for_red_hat_openshift:logback-core", "openshift_serverless:openshift-serverless-1/kn-ekb-dispatcher-rhel9", "openshift_serverless:openshift-serverless-1/kn-ekb-receiver-rhel9", "red_hat_amq_broker_7:logback-core", "red_hat_amq_clients:logback-core", "red_hat_build_of_apache_camel_-_hawtio_4:logback-core", "red_hat_build_of_apache_camel_for_spring_boot_4:logback-core", "red_hat_build_of_debezium_2:logback-core", "red_hat_build_of_debezium_3:logback-core", "red_hat_build_of_optaplanner_8:logback-core", "red_hat_data_grid_8:logback-core", "red_hat_enterprise_linux_10:jcl-over-slf4j", "red_hat_enterprise_linux_10:jul-to-slf4j", "red_hat_enterprise_linux_10:log4j-over-slf4j", "red_hat_enterprise_linux_10:slf4j-javadoc", "red_hat_enterprise_linux_10:slf4j-jcl", "red_hat_enterprise_linux_10:slf4j-jdk14", "red_hat_enterprise_linux_10:slf4j-manual", "red_hat_enterprise_linux_10:slf4j-migrator", "red_hat_enterprise_linux_10:slf4j-sources", "red_hat_enterprise_linux_10:slf4j.src", "red_hat_enterprise_linux_8:jcl-over-slf4j::maven:3.8", "red_hat_enterprise_linux_8:jul-to-slf4j::maven:3.8", "red_hat_enterprise_linux_8:log4j", "red_hat_enterprise_linux_8:log4j-jcl", "red_hat_enterprise_linux_8:log4j-over-slf4j::maven:3.8", "red_hat_enterprise_linux_8:log4j-slf4j", "red_hat_enterprise_linux_8:log4j-web", "red_hat_enterprise_linux_8:slf4j-ext::maven:3.8", "red_hat_enterprise_linux_8:slf4j-javadoc::maven:3.8", "red_hat_enterprise_linux_8:slf4j-jcl::maven:3.8", "red_hat_enterprise_linux_8:slf4j-jdk14::maven:3.8", "red_hat_enterprise_linux_8:slf4j-log4j12::maven:3.8", "red_hat_enterprise_linux_8:slf4j-manual::maven:3.8", "red_hat_enterprise_linux_8:slf4j-sources::maven:3.8", "red_hat_enterprise_linux_8:slf4j.src::maven:3.8", "red_hat_enterprise_linux_8:slf4j::maven:3.8", "red_hat_enterprise_linux_9:jcl-over-slf4j", "red_hat_enterprise_linux_9:log4j-jcl", "red_hat_enterprise_linux_9:log4j-slf4j", "red_hat_enterprise_linux_9:log4j.src", "red_hat_enterprise_linux_9:slf4j", "red_hat_enterprise_linux_9:slf4j-jdk14", "red_hat_enterprise_linux_9:slf4j.src", "red_hat_fuse_7:logback-core", "red_hat_jboss_enterprise_application_platform_7:logback-core", "red_hat_jboss_enterprise_application_platform_8:logback-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:logback-core", "red_hat_jboss_web_server_6:logback-core", "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9", "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9", "red_hat_openshift_dev_spaces:devspaces/server-rhel9", "red_hat_process_automation_7:logback-core", "red_hat_satellite_6:candlepin", "red_hat_satellite_6:candlepin-selinux", "red_hat_satellite_6:candlepin-selinux::satellite:el8", "red_hat_satellite_6:candlepin.src", "red_hat_satellite_6:candlepin.src::satellite:el8", "red_hat_satellite_6:candlepin::satellite:el8", "red_hat_satellite_6:puppetserver", "red_hat_satellite_6:puppetserver.src", "red_hat_satellite_6:puppetserver.src::satellite-capsule:el8", "red_hat_satellite_6:puppetserver::satellite-capsule:el8", "red_hat_single_sign-on_7:logback-core", "streams_for_apache_kafka_2:logback-core", "streams_for_apache_kafka_3:logback-core" ] } ], "threats": [ { "category": "impact", "details": "Moderate", "product_ids": [ "logging_subsystem_for_red_hat_openshift:logback-core", "openshift_serverless:openshift-serverless-1/kn-ekb-dispatcher-rhel9", "openshift_serverless:openshift-serverless-1/kn-ekb-receiver-rhel9", "red_hat_amq_broker_7:logback-core", "red_hat_amq_clients:logback-core", "red_hat_build_of_apache_camel_-_hawtio_4:logback-core", "red_hat_build_of_apache_camel_for_spring_boot_4:logback-core", "red_hat_build_of_debezium_2:logback-core", "red_hat_build_of_debezium_3:logback-core", "red_hat_build_of_optaplanner_8:logback-core", "red_hat_data_grid_8:logback-core", "red_hat_enterprise_linux_10:jcl-over-slf4j", "red_hat_enterprise_linux_10:jul-to-slf4j", "red_hat_enterprise_linux_10:log4j-over-slf4j", "red_hat_enterprise_linux_10:slf4j-javadoc", "red_hat_enterprise_linux_10:slf4j-jcl", "red_hat_enterprise_linux_10:slf4j-jdk14", "red_hat_enterprise_linux_10:slf4j-manual", "red_hat_enterprise_linux_10:slf4j-migrator", "red_hat_enterprise_linux_10:slf4j-sources", "red_hat_enterprise_linux_10:slf4j.src", "red_hat_enterprise_linux_8:jcl-over-slf4j::maven:3.8", "red_hat_enterprise_linux_8:jul-to-slf4j::maven:3.8", "red_hat_enterprise_linux_8:log4j", "red_hat_enterprise_linux_8:log4j-jcl", "red_hat_enterprise_linux_8:log4j-over-slf4j::maven:3.8", "red_hat_enterprise_linux_8:log4j-slf4j", "red_hat_enterprise_linux_8:log4j-web", "red_hat_enterprise_linux_8:slf4j-ext::maven:3.8", "red_hat_enterprise_linux_8:slf4j-javadoc::maven:3.8", "red_hat_enterprise_linux_8:slf4j-jcl::maven:3.8", "red_hat_enterprise_linux_8:slf4j-jdk14::maven:3.8", "red_hat_enterprise_linux_8:slf4j-log4j12::maven:3.8", "red_hat_enterprise_linux_8:slf4j-manual::maven:3.8", "red_hat_enterprise_linux_8:slf4j-sources::maven:3.8", "red_hat_enterprise_linux_8:slf4j.src::maven:3.8", "red_hat_enterprise_linux_8:slf4j::maven:3.8", "red_hat_enterprise_linux_9:jcl-over-slf4j", "red_hat_enterprise_linux_9:log4j-jcl", "red_hat_enterprise_linux_9:log4j-slf4j", "red_hat_enterprise_linux_9:log4j.src", "red_hat_enterprise_linux_9:slf4j", "red_hat_enterprise_linux_9:slf4j-jdk14", "red_hat_enterprise_linux_9:slf4j.src", "red_hat_fuse_7:logback-core", "red_hat_jboss_enterprise_application_platform_7:logback-core", "red_hat_jboss_enterprise_application_platform_8:logback-core", "red_hat_jboss_enterprise_application_platform_expansion_pack:logback-core", "red_hat_jboss_web_server_6:logback-core", "red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9", "red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9", "red_hat_openshift_dev_spaces:devspaces/server-rhel9", "red_hat_process_automation_7:logback-core", "red_hat_satellite_6:candlepin", "red_hat_satellite_6:candlepin-selinux", "red_hat_satellite_6:candlepin-selinux::satellite:el8", "red_hat_satellite_6:candlepin.src", "red_hat_satellite_6:candlepin.src::satellite:el8", "red_hat_satellite_6:candlepin::satellite:el8", "red_hat_satellite_6:puppetserver", "red_hat_satellite_6:puppetserver.src", "red_hat_satellite_6:puppetserver.src::satellite-capsule:el8", "red_hat_satellite_6:puppetserver::satellite-capsule:el8", "red_hat_single_sign-on_7:logback-core", "streams_for_apache_kafka_2:logback-core", "streams_for_apache_kafka_3:logback-core" ] } ], "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes" } ] }