RHLW-2026-4f8afe0cda7c5f03

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-4f8afe0cda7c5f03.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-4f8afe0cda7c5f03.json
JSON Data
https://api.osv.dev/v1/vulns/RHLW-2026-4f8afe0cda7c5f03
Upstream
CVE (2)
  • CVE-2026-104721
  • CVE-2026-19880
Published
2026-11-05T14:28:23Z
Modified
2026-11-06T19:30:02Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:X/V:X/RE:M/U:Green CVSS Calculator
Summary
Lightwell Security Advisory: logback-classic 1.5.16.rhlw-00003
Details

Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.16.rhlw-00003 with backported fixes for CVE-2026-104721 and CVE-2026-19880.

CVE-2026-104721: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.

This issue affects Logback-classic: from 0.9.14 through 1.6.4.  This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.

CVE-2026-19880: Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory.

This issue affects Logback-classic: from 0.9.14 through 1.6.2.

This patched artifact is a drop-in replacement for ch.qos.logback:logback-classic 1.5.16 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / ch.qos.logback:logback-classic

Package

Name
ch.qos.logback:logback-classic
Purl
pkg:maven/ch.qos.logback/logback-classic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.5.16.rhlw-00003

Affected versions

0.*
0.2.5
0.3
0.5
0.6
0.7
0.7.1
0.8
0.8.1
0.9
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.30
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.0.11
1.0.12
1.0.13
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.1.10
1.1.11
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.4-groovyless
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.2.12
1.2.13
1.3.0-alpha0
1.3.0-alpha1
1.3.0-alpha2
1.3.0-alpha3
1.3.0-alpha4
1.3.0-alpha5
1.3.0-alpha6
1.3.0-alpha7
1.3.0-alpha8
1.3.0-alpha9
1.3.0-alpha10
1.3.0-alpha11
1.3.0-alpha12
1.3.0-alpha13
1.3.0-alpha14
1.3.0-alpha15
1.3.0-alpha16
1.3.0-beta0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.3.10
1.3.11
1.3.12
1.3.13
1.3.14
1.3.15
1.3.16
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.4.10
1.4.11
1.4.12
1.4.13
1.4.14
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9
1.5.10
1.5.11
1.5.12
1.5.13
1.5.14
1.5.15
1.5.16

Database specific

lightwell 
{
    "backport_base_version": "1.5.16",
    "remediated_version": "1.5.16.rhlw-00003",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-4f8afe0cda7c5f03.json"