Overview
This advisory addresses a known security vulnerability identified in a third-party dependency used within DPGW.
Vulnerability Details
- CVE ID: CVE-2026-9828
- Dependency Name: ch.qos.logback:logback-classic (logback-core)
- Affected Version of Dependency: <= 1.5.32
- Severity Score: CNA 2.9 Low (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:P/RE:L/U:Green); NIST score not yet published
Affected Versions of DPGW
- <= 1.14.08-REL
- <= 1.13.29-REL
- <= 1.12.51-REL
- <= 1.11.47-REL
Risk Assessment & Applicability
Usage
DPGW uses Logback as its logging framework, initialized at startup by DPGWMain, and configured via conf/logback.xml. No DPGW deployment configures a SocketAppender or a socket-based log receiver.
Analysis
CVE-2026-0636
CVE-2026-9828 affects Logback’s HardenedObjectInputStream, a class used exclusively by Logback’s SimpleSocketServer and SimpleSSLSocketServer components to deserialize ILoggingEvent objects received over a network socket from a remote SocketAppender. In affected versions (through 1.5.32 inclusive), the hardening allow-list accepts a broader set of java.lang/java.util classes than intended, letting a party able to send crafted serialized data to such a socket server instantiate restricted objects and bypass the intended restriction. Exploitation requires the target application to actually run a SimpleSocketServer/SimpleSSLSocketServer instance reachable by the attacker; no remote code execution has been demonstrated, only a restriction bypass.
DPGW never instantiates or launches ch.qos.logback.classic.net.SimpleSocketServer or SimpleSSLSocketServer, and none of its logback.xml configurations (default or site-specific) define a SocketAppender or socket receiver. Logback is used purely as an in-process logging library, so the vulnerable deserialization code path is never reachable, locally or remotely.
Status
Not affected
Impact on DPGW
No impact. The vulnerable component is never invoked by DPGW.
Remediation & Mitigations
Scheduled fix
Not required for security reasons, but logback has already been bumped to the fixed version (1.5.37) as part of routine dependency maintenance on 2026-07-03. This will ship in the next release of:
– main / 1.14 branch (currently 1.14.08-REL)
– 1.13 branch (currently 1.13.29-REL)
– 1.12 branch (currently 1.12.51-REL)
The 1.11 branch (currently 1.11.47-REL, logback 1.5.16) has not received this bump. Since DPGW is Not Affected, no dedicated fix is scheduled for 1.11 at this time.
User Actions
No user action required.