{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"logback","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NK2FW4JS0R7ERJGXP3DSHF","modified_at":"2026-10-15T18:00:07.689154882Z","published_at":"2024-12-19T17:15:08.930Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2024-12801","https://security-tracker.debian.org/tracker/CVE-2024-12801"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2024-12801#Debian:13/logback","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2024-12801"}],"summary":"Server-Side Request Forgery (SSRF) in SaxEventRecorder by QOS.CH logback version 0.1 to 1.3.14 and 1.4.0 to 1.5.12 on the Java platform, allows an attacker to forge requests by compromising logback co"}