Expression Injection Affecting ch.qos.logback:logback-core package, versions [0.9.20,1.5.36)
Threat Intelligence
This vulnerability is trending on Twitter; this may indicate a growing threat.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Expression Injection vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JAVA-CHQOSLOGBACK-17675439
- published29 Jun 2026
- disclosed24 Jun 2026
- creditIcySun,yulate
Introduced: 24 Jun 2026
CVE-2026-13006 (opens in a new tab)How to fix?
Upgrade ch.qos.logback:logback-core to version 1.5.36 or higher.
Overview
ch.qos.logback:logback-core is a logback-core module.
Affected versions of this package are vulnerable to Expression Injection in the Janino-evaluated condition attribute of <if> configuration elements, handled by IfModelHandler, whose denylist blocked only the literal new operator. A user who can modify the logback configuration can execute arbitrary code by writing an <if> condition that evades that denylist, either through references it did not cover such as Runtime or springframework, or through Unicode escape sequences like \u that reconstruct the blocked new operator. Exploitation requires write access to the logback configuration and the use of conditional <if> processing with Janino present on the classpath.