CVE-2023-6378 Logback "receiver" DOS vulnerability
An attacker can cause a Denial of Service in Logback by sending poisoned data to the receiver component, which requires the receiver to be enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-6378?
CVE-2023-6378 is a high-severity unsafe deserialization vulnerability in QOS.CH Sarl logback, published on 29 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending poisoned data.
Weakness: CWE-502
Which versions are affected by CVE-2023-6378?
12 open source packages ship an affected version, including ch.qos.logback:logback-classic and ch.qos.logback:logback-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ch.qos.logback:logback-classic Maven | All versions | 1.2.13 |
ch.qos.logback:logback-classic Maven | All versions | 1.2.13 |
ch.qos.logback:logback-classic Maven | From 1.3.0 | 1.3.12 |
ch.qos.logback:logback-classic Maven | From 1.3.0 | 1.3.12 |
ch.qos.logback:logback-classic Maven | From 1.4.0 | 1.4.12 |
ch.qos.logback:logback-classic Maven | From 1.4.0 | 1.4.12 |
6 more packages
ch.qos.logback:logback-core Maven | All versions | 1.2.13 |
ch.qos.logback:logback-core Maven | All versions | 1.2.13 |
ch.qos.logback:logback-core Maven | From 1.3.0 | 1.3.12 |
ch.qos.logback:logback-core Maven | From 1.3.0 | 1.3.12 |
ch.qos.logback:logback-core Maven | From 1.4.0 | 1.4.12 |
ch.qos.logback:logback-core Maven | From 1.4.0 | 1.4.12 |
Products include Qos Logback.
How do I fix CVE-2023-6378?
Upgrade ch.qos.logback:logback-classic to a fixed version for your release line: 1.2.13, 1.3.12 or 1.4.12.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-6378 being exploited?
There is no known exploitation of CVE-2023-6378 in the wild and no public exploit code.
Other vulnerabilities in QOS.CH Sarl logback
Sources
Also known as CLEANSTART-2026-BZ13622, CLEANSTART-2026-IB17360, DEBIAN-CVE-2023-6378, ECHO-042f-77a6-c297, GHSA-vmq6-5m68-f53m, MINI-364p-p32q-2x4h and 5 more.