NES for Logback 1.2.x Release Notes

Security Fixes

This release patches the following:

• A Joran <evaluator> element can no longer compile and execute a Java expression, because JaninoEventEvaluator is removed from logback-classic and logback-access along with JaninoEventEvaluatorBase in logback-core (CVE-2024-12798).
• A Document Type Declaration naming an external file is no longer resolved by SaxEventRecorder, so a logback configuration can no longer make the parser fetch a URL of its choosing (CVE-2024-12801).
• A Joran <if> element's condition attribute containing the new operator is no longer compiled or evaluated by IfAction (CVE-2025-11226).
• A class named in the class attribute of a nested configuration element is no longer instantiated by NestedComplexPropertyIA unless it is assignable to the type the enclosing component expects (CVE-2026-1225).
• HardenedObjectInputStream no longer authorizes an incoming class just because its name begins with java.lang or java.util, so a peer that can influence the serialized data reaching SimpleSocketServer or SimpleSSLSocketServer can no longer have arbitrary serializable classes from those packages instantiated (CVE-2026-9828).
• Dynamic proxy classes can no longer be instantiated during deserialization by HardenedObjectInputStream, so a serialized stream reaching SimpleSocketServer or SimpleSSLSocketServer can no longer bypass its class whitelist through a proxy class descriptor (CVE-2026-10532).
• The condition attribute of a Joran <if> element is no longer compiled and executed as Java. Conditions are now parsed against a fixed grammar and evaluated directly, closing an arbitrary-code-execution path available to anyone able to write a logback configuration file or point logback at one (CVE-2026-13006).
• An MDC value that contains a path separator, a relative path component such as .., a variable substitution such as ${file.separator}, or any other character unsafe in a path segment is no longer used as a discriminating value by MDCBasedDiscriminator, so a SiftingAppender's nested file appender can no longer be steered outside its configured directory (CVE-2026-104721, CVE-2026-19880).

Evaluator Changes

The fix for CVE-2024-12798 removes the Janino-backed evaluator. <evaluator> still works, but only with an explicit class attribute naming your own EventEvaluator implementation. There is no longer a default evaluator, so a configuration that relied on an inline Janino <expression> must supply a class instead.

Conditional Processing Changes

The fix for CVE-2026-13006 changes how <if> conditions are evaluated. Review this section before upgrading if your configuration uses conditional processing.

Conditional processing continues to work for property inspection, which is what the condition attribute is documented to support: property("key") and p("key"), isDefined("key"), isNull("key"), the string tests contains, equals, equalsIgnoreCase, startsWith, endsWith and isEmpty, comparison of one property to another, the operators &&, || and ! with parentheses, the literals true and false, and comparison of two integer literals.

Conditions that rely on arbitrary Java no longer work and are reported as a configuration error, with the <if> element skipped. This includes arithmetic on property values, method and constructor calls, System.getProperty(...), chained calls such as .toLowerCase().contains(...), casts, instanceof and ternary expressions. These were never part of the documented contract — the manual states that only context and system properties are accessible from a condition — but were possible because Janino is a full Java compiler. Note that property(...) already consults system properties, so System.getProperty(...) has a direct equivalent.

The Janino library is no longer required and is no longer declared as a dependency of logback-core, logback-classic or logback-access. Conditional processing now works whether or not Janino is on the class path; previously its absence silently disabled every condition. Applications that relied on logback to bring Janino in transitively must now declare it themselves.

For API consumers, PropertyEvalScriptBuilder.build(String) now throws ConditionParseException instead of Janino's CompileException, and OptionHelper.containsUnicodeEscape has been removed.

Notes

This release also publishes the javadoc and test-javadoc classifiers alongside the existing sources, test-sources and tests jars, matching what upstream 1.2.13 ships.