Is CVE-2025-11226 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-11226 being exploited in the wild.

How severe is CVE-2025-11226?

Medium severity, with a CVSS score of 4, published 1 October 2025.

Which products and versions are affected?

ch.qos.logback:logback-core (Maven) ECOSYSTEM:introduced=1.4.0,fixed=1.5.19; QOS.CH Sarl Logback-Core 0.9.20 to 1.5.18.

Is there a fix for CVE-2025-11226?

Yes. ch.qos.logback:logback-core (Maven): upgrade to 1.5.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-11226 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-11226?

Check whether you run ch.qos.logback:logback-core (Maven) or QOS.CH Sarl Logback-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-11226: QOS.CH Logback-core code execution in conditional configuration processing

CVE-2025-11226 · Severity: medium · CVSS 4 · Published 2025-10-01

Logback is a popular logging framework used by Java applications to record system events. A vulnerability in how it processes configuration files could allow an attacker who already has high-level access to the system to execute malicious code. To be successful, the attacker must be able to modify the application's configuration files or environment variables, and the application must be using specific common Java libraries like Spring Framework.

Technologies: ch.qos.logback:logback-core (Maven), QOS.CH Sarl Logback-Core. Vendors: Maven, QOS.CH Sarl.

Quick answers

Is CVE-2025-11226 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-11226 being exploited in the wild.
How severe is CVE-2025-11226?: Medium severity, with a CVSS score of 4, published 1 October 2025.
Which products and versions are affected?: ch.qos.logback:logback-core (Maven) ECOSYSTEM:introduced=1.4.0,fixed=1.5.19; QOS.CH Sarl Logback-Core 0.9.20 to 1.5.18.
Is there a fix for CVE-2025-11226?: Yes. ch.qos.logback:logback-core (Maven): upgrade to 1.5.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-11226 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-11226?: Check whether you run ch.qos.logback:logback-core (Maven) or QOS.CH Sarl Logback-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ch.qos.logback:logback-core (Maven): upgrade to 1.5.19 or later

# set ch.qos.logback:logback-core to 1.5.19 in your pom.xml or build.gradle

Technical details

An Arbitrary Code Execution (ACE) vulnerability exists in logback-core versions up to 1.5.18 during the processing of conditional configuration files. The vulnerability is triggered when an attacker with existing high privileges (PR:H) modifies a logback configuration file or injects an environment variable pointing to a malicious configuration. Exploitation requires the Janino library and Spring Framework to be present on the application's classpath. This allows the attacker to execute arbitrary Java code through the configuration's conditional logic. The issue is addressed in versions 1.3.16 and 1.5.19.

Affected products

QOS.CH Sarl Logback-core 0.9.20 to 1.5.18

Identifiers

CVE-2025-11226
GHSA-25qh-j22f-pwp8

Timeline

2025-10-01: disclosed
2025-10-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.