01 Record

CVE-2026-19880

Incomplete protection against CVE-2025-11226

MediumPUBLISHEDCNA: NCSC.ch

Base score6.3 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green

View raw JSON CVE Program record

02 Description

Incomplete protection against CVE-2025-11226

03 Metadata

Published: 2026-08-14 14:31Z4 HR AGO
Last updated: 2026-08-14 14:31Z4 HR AGO
Reserved: 2026-08-14
Assigning CNA: NCSC.ch
Record state: PUBLISHED
Severity: Medium (CVSS 6.3)
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green
Weaknesses: CWE-22
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: a6edd723f8143ffa177ff1cd1940e29c29791fdcfe3004a60512fe4bcc4c9ce2

04 Affected products

VendorProductVersionsPlatforms

QOS.CH SarlLogback-classic0.9.14 to 1.6.2Java

05 References

logback.qos.chhttps://logback.qos.ch/news.html#1.6.3

06 Remediation

Update to logack version 1.6.3 or later. This vulnerability requires SiftingAppender to be active as well as unsanitized data provided by an attacker that MDCDiscriminator makes use of. Sanitizing relevant data provided by the user should fix this vulnerability.