Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to SimpleSocketServer or SimpleSSLSocketServer can instantiate objects from classes in the java.lang and java.util packages that are not explicitly blocked. Although deserialization is heavily restricted by HardenedObjectInputStream and no practical way to achieve remote code execution or significant privilege escalation has been identified, this issue constitutes a bypass of the intended security restrictions. This issue affects logback: through 1.5.32 inclusive.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core
    (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted. More
    precisely, an attacker able to influence serialized data sent to SimpleSocketServer or
    SimpleSSLSocketServer can instantiate objects from classes in the java.lang and java.util packages that
    are not explicitly blocked. Although deserialization is heavily restricted by HardenedObjectInputStream
    and no practical way to achieve remote code execution or significant privilege escalation has been
    identified, this issue constitutes a bypass of the intended security restrictions. This issue affects
    logback: through 1.5.32 inclusive. (CVE-2026-9828)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core     (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted. More     precisely, an attacker able to influence serialized data sent to SimpleSocketServer or     SimpleSSLSocketServer can instantiate objects from classes in the java.lang and java.util packages that     are not explicitly blocked. Although deserialization is heavily restricted by HardenedObjectInputStream     and no practical way to achieve remote code execution or significant privilege escalation has been     identified, this issue constitutes a bypass of the intended security restrictions. This issue affects     logback: through 1.5.32 inclusive. (CVE-2026-9828)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
457846	Echo: ch.qos.logback:logback-core: security update to 1.5.33	Tenable Cloud Security	Echo Local Security Checks	Local	medium
457846	Echo: ch.qos.logback:logback-core: security update to 1.5.33	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
317954	Linux Distros Unpatched Vulnerability : CVE-2026-9828	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-9828

medium

Tenable Plugins

medium

medium

medium