Logback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix
At a glance
Severity
HIGH 7.1
EPSS
EPSS 0.68 % · percentile 52 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
NCSC.ch
NVD status
Modified
Description
A serialization vulnerability in logback receiver component part of
logback version 1.4.13, 1.3.13 and 1.2.12 allows an attacker to mount a Denial-Of-Service
attack by sending poisoned data.
Scores
Version
Score
Vector
Scored by
CVSS 3.1
HIGH 7.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NCSC.ch
CVSS 3.1
HIGH 7.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD · vulnerability@ncsc.ch (Secondary)
CVSS 3.1
HIGH 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD · nvd@nist.gov (Primary)
Advisories
GHSA-gm62-rw4g-vrc4 — Logback is vulnerable to an attacker mounting a Denial-Of-Service attack by sending poisoned data
