RHLW-2026-730f8211b080b586

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-730f8211b080b586.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-730f8211b080b586.json
JSON Data
https://api.osv.dev/v1/vulns/RHLW-2026-730f8211b080b586
Upstream
  • CVE-2026-1225
Published
2026-10-16T12:36:14Z
Modified
2026-10-27T08:45:02Z
Severity
  • 1.8 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:X/RE:M/U:Green CVSS Calculator
Summary
Lightwell Security Advisory: logback-core 1.5.18.rhlw-00003
Details

Red Hat Lightwell has released ch.qos.logback:logback-core 1.5.18.rhlw-00003 with a backported security fix.

CVE-2026-1225: ACE vulnerability in configuration file processing by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.

The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must have write access to a configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.

This patched artifact is a drop-in replacement for ch.qos.logback:logback-core 1.5.18 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / ch.qos.logback:logback-core

Package

Name
ch.qos.logback:logback-core
Purl
pkg:maven/ch.qos.logback/logback-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.5.18.rhlw-00003

Affected versions

0.*
0.2.5
0.3
0.5
0.6
0.7
0.7.1
0.8
0.8.1
0.9
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
0.9.10
0.9.11
0.9.12
0.9.13
0.9.14
0.9.15
0.9.16
0.9.17
0.9.18
0.9.19
0.9.20
0.9.21
0.9.22
0.9.23
0.9.24
0.9.25
0.9.26
0.9.27
0.9.28
0.9.29
0.9.30
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.0.9
1.0.10
1.0.11
1.0.12
1.0.13
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.1.10
1.1.11
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.4-groovyless
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.2.10
1.2.11
1.2.12
1.2.13
1.3.0-alpha0
1.3.0-alpha1
1.3.0-alpha2
1.3.0-alpha3
1.3.0-alpha4
1.3.0-alpha5
1.3.0-alpha6
1.3.0-alpha7
1.3.0-alpha8
1.3.0-alpha9
1.3.0-alpha10
1.3.0-alpha11
1.3.0-alpha12
1.3.0-alpha13
1.3.0-alpha14
1.3.0-alpha15
1.3.0-alpha16
1.3.0-beta0
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.3.8
1.3.9
1.3.10
1.3.11
1.3.12
1.3.13
1.3.14
1.3.15
1.3.16
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.4.10
1.4.11
1.4.12
1.4.13
1.4.14
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.5.9
1.5.10
1.5.11
1.5.12
1.5.13
1.5.14
1.5.15
1.5.16
1.5.17
1.5.18

Database specific

lightwell 
{
    "backport_base_version":  "1.5.18",
    "remediated_version":  "1.5.18.rhlw-00003",
    "repository_url":  "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-730f8211b080b586.json"