USN-9052-1: logback vulnerability
Published Nov 11, 2026
·Updated
It was discovered that Logback incorrectly handled deserialization of untrusted data in its socket server and receiver components. A remote attacker could possibly use this issue to execute arbitrary code.
Affected Software
3 affected componentsFixes available
ubuntu/logback<1:1.1.3-2ubuntu0.1~esm1
1:1.1.3-2ubuntu0.1~esm1
All of the following
ubuntu/liblogback-java<1:1.1.3-2ubuntu0.1~esm1
1:1.1.3-2ubuntu0.1~esm1
Ubuntu Ubuntu=16.04
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/logbackto a version that resolves this vulnerability.Fixed in 1:1.1.3-2ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/liblogback-javato a version that resolves this vulnerability.Fixed in 1:1.1.3-2ubuntu0.1~esm1
Event History
Nov 11, 2026
Advisory Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
DescriptionAffected Software
Advisory Published
via OSV·06:31 PM
Data Sourced
via OSV·06:31 PM
DescriptionAffected Software
Frequently Asked Questions
1
Which Logback components are affected?
The issue affects Logback's socket server and receiver components, where untrusted data may be deserialized.
2
What could an attacker achieve?
A remote attacker could possibly execute arbitrary code by exploiting the unsafe handling of untrusted serialized data.