SB2026031035 - Input validation error in QOS.CH logback-core
Published: March 10, 2026
Security Bulletin ID
SB2026031035
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2026-1225)
The vulnerability allows a local privileged user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A local privileged user can instantiate classes already present on the class path by compromising an existing logback configuration file. The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file.
Remediation
Install update from vendor's website.