# $schema: https://vulnlog.dev/schema/vulnlog-v1.json --- schemaVersion: "1" project: organization: Vulnlog name: Vulnlog author: Vulnlog Dev Team tags: - id: cli description: The CLI release artifact - id: gradle plugin description: The Gradle plugin release artifact - id: dev dependency description: Indicates that the vulnerability is related to development dependencies releases: - id: 0.11.0 published_at: 2026-04-06 - id: 0.12.0 published_at: 2026-04-19 - id: 0.13.0 published_at: 2026-05-03 - id: 0.14.0 published_at: 2026-05-19 - id: 0.15.0 published_at: 2026-06-22 - id: 0.15.1 published_at: 2026-06-29 - id: 0.16.0 published_at: 2026-07-16 - id: 0.17.0 published_at: 2026-08-24 - id: 0.18.0 vulnerabilities: - id: SNYK-JAVA-CHQOSLOGBACK-17675449 description: Deserialization of untrusted data vulnerability in `HardenedObjectInputStream` of `logback-core`. releases: [0.15.1] packages: ["pkg:maven/ch.qos.logback/logback-core@1.3.14"] reports: - reporter: snyk at: 2026-07-02 tags: [dev dependency] analysis: >- The logback-core dependency is not used by the Vulnlog project and is only used transitively by the Ktlinter Gradle plugin in the build. verdict: not affected justification: vulnerable code cannot be controlled by adversary resolution: in: 0.17.0 at: 2026-08-18 ref: "https://github.com/vulnlog/vulnlog/pull/253" note: Security scans now cover release artifacts only, where ktlint's logback is not present. comment: >- The issue is fixed in `ch.qos.logback:logback-core:1.5.33` however the Gradle Ktlint plugin `org.jlleitschuh.gradle:ktlint-gradle` does not yet use the fixed version. - id: SNYK-JAVA-CHQOSLOGBACK-17675450 description: Deserialization of untrusted data vulnerability in `HardenedObjectInputStream` of `logback-classic`. releases: [0.15.1] packages: ["pkg:maven/ch.qos.logback/logback-classic@1.3.14"] reports: - reporter: snyk at: 2026-07-02 tags: [dev dependency] analysis: >- The logback-classic dependency is not used by the Vulnlog project and is only used transitively by the Ktlinter Gradle plugin in the build. verdict: not affected justification: vulnerable code cannot be controlled by adversary resolution: in: 0.17.0 at: 2026-08-18 ref: "https://github.com/vulnlog/vulnlog/pull/253" note: Security scans now cover release artifacts only, where ktlint's logback is not present. comment: >- The issue is fixed in `ch.qos.logback:logback-classic:1.5.33` however the Gradle Ktlint plugin `org.jlleitschuh.gradle:ktlint-gradle` does not yet use the fixed version. - id: SNYK-JAVA-CHQOSLOGBACK-17675439 description: Expression injection vulnerability in Ktlints logback-core dependency. releases: [0.15.1] packages: ["pkg:maven/ch.qos.logback/logback-core@1.3.14"] reports: - reporter: snyk at: 2026-07-02 tags: [dev dependency] analysis: >- The logback-core dependency is not used by the Vulnlog project and is only used transitively by the Ktlinter Gradle plugin in the build. verdict: not affected justification: vulnerable code cannot be controlled by adversary resolution: in: 0.17.0 at: 2026-08-18 ref: "https://github.com/vulnlog/vulnlog/pull/253" note: Security scans now cover release artifacts only, where ktlint's logback is not present. comment: >- The issue is fixed in `ch.qos.logback:logback-core:1.5.36` however the Gradle Ktlint plugin `org.jlleitschuh.gradle:ktlint-gradle` does not yet use the fixed version. - id: SNYK-JAVA-TOOLSJACKSONCORE-17457696 description: >- Improperly controlled modification of dynamically-determined object attributes in Jackson's `BeanDeserializerBase.createContextual()` method. aliases: [CVE-2026-54515] releases: [0.15.0] packages: ["pkg:maven/tools.jackson.core/jackson-databind@3.1.1"] reports: - reporter: snyk at: 2026-06-29 - reporter: trivy at: 2026-06-29 vuln_ids: [CVE-2026-54515] tags: - cli - gradle plugin analysis: Vulnlog uses Jackson for de-/serialization but the method in question is not used. verdict: not affected justification: vulnerable code not present resolution: in: 0.15.1 at: 2026-06-29 ref: "https://github.com/vulnlog/vulnlog/pull/183" comment: Fixed in Jackson 3.1.4 - id: SNYK-JAVA-TOOLSJACKSONCORE-17457396 description: >- Improperly controlled modification of dynamically-determined object attributes in Jackson's `POJOPropertiesCollector._renameProperties()` and `BeanDeserializerFactory.addBeanProps()` methods. aliases: [CVE-2026-54516] releases: [0.15.0] packages: ["pkg:maven/tools.jackson.core/jackson-databind@3.1.1"] reports: - reporter: snyk at: 2026-06-29 - reporter: trivy at: 2026-06-29 vuln_ids: [CVE-2026-54516] tags: - cli - gradle plugin analysis: Vulnlog uses Jackson for de-/serialization but the method in question is not used. verdict: not affected justification: vulnerable code not present resolution: in: 0.15.1 at: 2026-06-29 ref: "https://github.com/vulnlog/vulnlog/pull/183" comment: Fixed in Jackson 3.1.4 - id: SNYK-JAVA-TOOLSJACKSONCORE-17440359 description: >- Incorrect authorization in jackson's `UnwrappedPropertyHandler.processUnwrappedCreatorProperties()` method. aliases: [CVE-2026-54518] releases: [0.15.0] packages: ["pkg:maven/tools.jackson.core/jackson-databind@3.1.1"] reports: - reporter: snyk at: 2026-06-29 - reporter: trivy at: 2026-06-29 vuln_ids: [CVE-2026-54518] tags: - cli - gradle plugin analysis: Vulnlog uses Jackson for de-/serialization but the method in question is not used. verdict: not affected justification: vulnerable code not present resolution: in: 0.15.1 at: 2026-06-29 ref: "https://github.com/vulnlog/vulnlog/pull/183" comment: Fixed in Jackson 3.1.4 - id: SNYK-JAVA-TOOLSJACKSONCORE-17440306 description: Incorrect authorization in Jackson's `BeanDeserializer._deserializeUsingPropertyBased` method. aliases: [CVE-2026-54517] releases: [0.15.0] packages: ["pkg:maven/tools.jackson.core/jackson-databind@3.1.1"] reports: - reporter: snyk at: 2026-06-29 - reporter: trivy at: 2026-06-29 vuln_ids: [CVE-2026-54517] tags: - cli - gradle plugin analysis: Vulnlog uses Jackson for de-/serialization but the method in question is not used. verdict: not affected justification: vulnerable code not present resolution: in: 0.15.1 at: 2026-06-29 ref: "https://github.com/vulnlog/vulnlog/pull/183" comment: Fixed in Jackson 3.1.4 - id: SNYK-JAVA-TOOLSJACKSONCORE-17434789 description: Server-side request forgery (SSRF) vulnerability in Jacksons `JDKFromStringDeserializer`. aliases: [CVE-2026-54514] releases: [0.15.0] packages: ["pkg:maven/tools.jackson.core/jackson-databind@3.1.1"] reports: - reporter: snyk at: 2026-06-29 - reporter: trivy at: 2026-06-29 vuln_ids: [CVE-2026-54514] tags: - cli - gradle plugin analysis: Vulnlog uses Jackson for de-/serialization but the affected class is not used. verdict: not affected justification: vulnerable code not present resolution: in: 0.15.1 at: 2026-06-29 ref: "https://github.com/vulnlog/vulnlog/pull/183" comment: Fixed in Jackson 3.1.4 - id: SNYK-JAVA-TOOLSJACKSONCORE-17440365 description: >- Incomplete list of disallowed inputs in Jacksons `BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray()` methods. aliases: [CVE-2026-54513] releases: [0.15.0] packages: ["pkg:maven/tools.jackson.core/jackson-databind@3.1.1"] reports: - reporter: snyk at: 2026-06-29 - reporter: trivy at: 2026-06-29 vuln_ids: [CVE-2026-54513] tags: - cli - gradle plugin analysis: Vulnlog uses Jackson for de-/serialization but the method in question is not used. verdict: not affected justification: vulnerable code not present resolution: in: 0.15.1 at: 2026-06-29 ref: "https://github.com/vulnlog/vulnlog/pull/183" comment: Fixed in Jackson 3.1.4 - id: SNYK-JAVA-TOOLSJACKSONCORE-17440597 description: Deserialization of untrusted data in Jacksons `DatabindContext._resolveAndValidateGeneric()` method. aliases: [CVE-2026-54512] releases: [0.15.0] packages: ["pkg:maven/tools.jackson.core/jackson-databind@3.1.1"] reports: - reporter: snyk at: 2026-06-29 - reporter: trivy at: 2026-06-29 vuln_ids: [CVE-2026-54512] tags: - cli - gradle plugin analysis: Vulnlog uses Jackson for de-/serialization but the method in question is not used. verdict: not affected justification: vulnerable code not present resolution: in: 0.15.1 at: 2026-06-29 ref: "https://github.com/vulnlog/vulnlog/pull/183" comment: Fixed in Jackson 3.1.4 - id: SNYK-JAVA-TOOLSJACKSONCORE-15907550 description: Allocation of resources without limits or throttling vulnerability in Jackson aliases: [GHSA-2m67-wjpj-xhg9] releases: [0.11.0] packages: ["pkg:maven/tools.jackson.core/jackson-core@3.1.0"] reports: - reporter: snyk at: 2026-04-06 - reporter: trivy at: 2026-04-06 vuln_ids: [GHSA-2m67-wjpj-xhg9] analysis: The affected `StreamReadConstraints` is not used in the application. verdict: not affected justification: vulnerable code not in execute path resolution: in: 0.12.0 at: 2026-04-07 ref: "https://github.com/vulnlog/vulnlog/pull/82" comment: Fix will be in 3.1.1 - id: CVE-2023-6481 description: Uncontrolled resource consumption (resource exhaustion) vulnerability in logback aliases: - SNYK-JAVA-CHQOSLOGBACK-6097492 - SNYK-JAVA-CHQOSLOGBACK-6097493 releases: [0.11.0] packages: - "pkg:maven/ch.qos.logback/logback-classic@1.3.5" - "pkg:maven/ch.qos.logback/logback-core@1.3.5" reports: - reporter: snyk at: 2026-04-06 vuln_ids: - SNYK-JAVA-CHQOSLOGBACK-6097492 - SNYK-JAVA-CHQOSLOGBACK-6097493 tags: [dev dependency] analysis: Logback is a ktlint configuration dependency and not part of the application. analyzed_at: 2026-04-06 verdict: risk acceptable severity: low resolution: in: 0.12.0 at: 2026-04-07 note: Update ktlint to 14.2.0 also updates logback to 1.3.14 - id: CVE-2020-29582 description: Information exposure vulnerability in Kotlin stdlib aliases: [SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744] releases: [0.11.0] packages: ["pkg:maven/org.jetbrains.kotlin/kotlin-stdlib@1.9.10"] reports: - reporter: snyk at: 2026-04-06 vuln_ids: [SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744] tags: [dev dependency] analysis: Old kotlin-stdlib is a transitive dependency of ktlint configuration. analyzed_at: 2026-04-07 verdict: risk acceptable severity: low resolution: in: 0.12.0 at: 2026-04-07 note: Update ktlint to 14.2.0 also updates kotlin-stdlib to 2.1.0 - id: CVE-2023-6378 description: Denial of service (DoS) vulnerability in logback aliases: - SNYK-JAVA-CHQOSLOGBACK-6094942 - SNYK-JAVA-CHQOSLOGBACK-6094943 releases: [0.11.0] packages: - "pkg:maven/ch.qos.logback/logback-core@1.3.5" - "pkg:maven/ch.qos.logback/logback-classic@1.3.5" reports: - reporter: trivy at: 2026-04-06 - reporter: snyk at: 2026-04-06 vuln_ids: - SNYK-JAVA-CHQOSLOGBACK-6094943 - SNYK-JAVA-CHQOSLOGBACK-6094942 tags: [dev dependency] analysis: Logback is a ktlint configuration dependency and not part of the application. analyzed_at: 2026-04-06 verdict: risk acceptable severity: low resolution: in: 0.12.0 at: 2026-04-07 note: Update ktlint to 14.2.0 also updates logback to 1.3.14 - id: CVE-2025-11226 description: External initialization of trusted variables or data stores vulnerability in Logback aliases: [SNYK-JAVA-CHQOSLOGBACK-13169722] releases: [0.11.0] packages: ["pkg:maven/ch.qos.logback/logback-core@1.3.14"] reports: - reporter: trivy at: 2026-04-07 suppress: {} - reporter: snyk at: 2026-04-07 vuln_ids: [SNYK-JAVA-CHQOSLOGBACK-13169722] suppress: {} tags: [dev dependency] analysis: Logback is a ktlint configuration dependency and not part of the application. analyzed_at: 2026-04-07 verdict: risk acceptable severity: low resolution: in: 0.17.0 at: 2026-08-18 ref: "https://github.com/vulnlog/vulnlog/pull/253" note: Security scans now cover release artifacts only, where ktlint's logback is not present. comment: "Fix will be in 1.3.15; Check for newer ktlint versions https://github.com/JLLeitschuh/ktlint-gradle" - id: CVE-2024-12798 description: Improper neutralization of special elements vulnerability in Logback aliases: - SNYK-JAVA-CHQOSLOGBACK-8539867 - SNYK-JAVA-CHQOSLOGBACK-8539866 releases: [0.11.0] packages: ["pkg:maven/ch.qos.logback/logback-core@1.3.14"] reports: - reporter: trivy at: 2026-04-07 suppress: {} - reporter: snyk at: 2026-04-07 vuln_ids: - SNYK-JAVA-CHQOSLOGBACK-8539867 - SNYK-JAVA-CHQOSLOGBACK-8539866 suppress: {} tags: [dev dependency] analysis: Logback is a ktlint configuration dependency and not part of the application. analyzed_at: 2026-04-07 verdict: risk acceptable severity: low resolution: in: 0.17.0 at: 2026-08-18 ref: "https://github.com/vulnlog/vulnlog/pull/253" note: Security scans now cover release artifacts only, where ktlint's logback is not present. comment: "Fix will be in 1.3.15; Check for newer ktlint versions https://github.com/JLLeitschuh/ktlint-gradle" - id: CVE-2026-1225 description: External initialization of trusted variables or data stores vulnerability in Logback aliases: [SNYK-JAVA-CHQOSLOGBACK-15062482] releases: [0.11.0] packages: ["pkg:maven/ch.qos.logback/logback-core@1.3.14"] reports: - reporter: trivy at: 2026-04-06 suppress: {} - reporter: snyk at: 2026-04-07 vuln_ids: [SNYK-JAVA-CHQOSLOGBACK-15062482] suppress: {} tags: [dev dependency] analysis: Logback is a ktlint configuration dependency and not part of the application. analyzed_at: 2026-04-06 verdict: risk acceptable severity: low resolution: in: 0.17.0 at: 2026-08-18 ref: "https://github.com/vulnlog/vulnlog/pull/253" note: Security scans now cover release artifacts only, where ktlint's logback is not present. comment: "Fix will be in 1.3.15; Check for newer ktlint versions https://github.com/JLLeitschuh/ktlint-gradle" - id: CVE-2024-12801 description: Server-side request forgery (SSRF) vulnerability in Logback aliases: [SNYK-JAVA-CHQOSLOGBACK-8539865] releases: [0.11.0] packages: ["pkg:maven/ch.qos.logback/logback-core@1.3.14"] reports: - reporter: trivy at: 2026-04-07 suppress: {} - reporter: snyk at: 2026-04-06 vuln_ids: [SNYK-JAVA-CHQOSLOGBACK-8539865] suppress: {} tags: [dev dependency] analysis: Logback is a ktlint configuration dependency and not part of the application. analyzed_at: 2026-04-06 verdict: risk acceptable severity: low resolution: in: 0.17.0 at: 2026-08-18 ref: "https://github.com/vulnlog/vulnlog/pull/253" note: Security scans now cover release artifacts only, where ktlint's logback is not present. comment: "Fix will be in 1.3.15; Check for newer ktlint versions https://github.com/JLLeitschuh/ktlint-gradle"