Uncontrolled Resource Consumption ('Resource Exhaustion') Affecting ch.qos.logback:logback-classic package, versions [,1.2.13)[1.3.0,1.3.14)[1.4.0,1.4.14)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.09% (40th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JAVA-CHQOSLOGBACK-6097492
  • published4 Dec 2023
  • disclosed4 Dec 2023
  • creditUnknown

Introduced: 4 Dec 2023

CVE-2023-6481  (opens in a new tab)
CWE-400  (opens in a new tab)

How to fix?

Upgrade ch.qos.logback:logback-classic to version 1.2.13, 1.3.14, 1.4.14 or higher.

Overview

ch.qos.logback:logback-classic is a reliable, generic, fast and flexible logging library for Java.

Affected versions of this package are vulnerable to Uncontrolled Resource Consumption ('Resource Exhaustion') via the logback receiver component. An attacker can mount a denial-of-service attack by sending poisoned data.

Note:

Successful exploitation requires the logback-receiver component being enabled and also reachable by the attacker.

CVSS Scores

version 3.1