Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-24T05:41:32 logback-core: Logback-core: Arbitrary Code Execution via Malicious Configuration or Environment Variable 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N CWE-94

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration file or by injecting an environment variable before program execution. A successful attack requires the presence of Janino library to be present on the user's class path. In addition, the attacker must  have write access to a configuration file. Alternatively, the attacker could inject a malicious environment variable pointing to a malicious configuration file. In both cases, the attack requires existing privilege. Please note that in logack version 1.5.37 conditional processing using Janino was removed.

A flaw was found in logback-core, a logging framework for Java applications. This vulnerability allows an attacker with existing privileges and write access to a configuration file, or the ability to inject a malicious environment variable, to execute arbitrary code. This can be achieved by compromising an existing logback configuration file or by injecting an environment variable before program execution, circumventing existing protections. A successful attack requires the Janino library to be present on the user's class path.

Migration Toolkit for Applications 8 Fix deferred mta/mta-cli-rhel9 Migration Toolkit for Applications 8 Fix deferred mta/mta-java-external-provider-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/kn-ekb-dispatcher-rhel9 OpenShift Serverless Fix deferred openshift-serverless-1/kn-ekb-receiver-rhel9 Red Hat AMQ Broker 7 Fix deferred logback-core Red Hat AMQ Clients Fix deferred logback-core Red Hat build of Apache Camel for Spring Boot 4 Fix deferred logback-core Red Hat build of Apache Camel - HawtIO 4 Fix deferred logback-core Red Hat build of Debezium 3 Fix deferred logback-core Red Hat Data Grid 8 Fix deferred logback-core Red Hat Enterprise Linux 10 Fix deferred slf4j Red Hat Enterprise Linux 8 Fix deferred log4j:2/log4j Red Hat Enterprise Linux 8 Fix deferred maven:3.8/slf4j Red Hat Enterprise Linux 9 Fix deferred maven:3.9/slf4j Red Hat Enterprise Linux 9 Fix deferred slf4j Red Hat Fuse 7 Fix deferred logback-core Red Hat JBoss Enterprise Application Platform 7 Fix deferred logback-core Red Hat JBoss Enterprise Application Platform 8 Fix deferred logback-core Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred logback-core Red Hat JBoss Web Server 6 Fix deferred logback-core Red Hat OpenShift Dev Spaces Fix deferred devspaces/openvsx-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/pluginregistry-rhel9 Red Hat OpenShift Dev Spaces Fix deferred devspaces/server-rhel9 Red Hat Satellite 6 Fix deferred candlepin Red Hat Satellite 6 Fix deferred openvox-server Red Hat Satellite 6 Fix deferred puppetserver Red Hat Satellite 6 Fix deferred satellite:el8/candlepin Red Hat Satellite 6 Fix deferred satellite:el8/puppetserver Red Hat Single Sign-On 7 Fix deferred logback-core streams for Apache Kafka 2 Fix deferred logback-core streams for Apache Kafka 3 Fix deferred logback-core https://www.cve.org/CVERecord?id=CVE-2026-13006 https://nvd.nist.gov/vuln/detail/CVE-2026-13006 https://logback.qos.ch/news.html#1.5.35