News

Logback related news and release notes

This page documents changes for various logback releases, including logback-core, logback-classic, logback-access, logback-tyler and logback-scoped-mdc.

For release notes of versions published before 2025, see the news archive.

Latest STABLE version: the 1.6.x series

The 1.6.x series is a direct descendant of, and a drop-in replacement for, the 1.5.x series, with the notable exception of conditionals using Janino (see next section). It contains a few optional components, such as SMTPAppender and LogbackServletContextListener, that depend on Jakarta EE (jakarta.* namespace). The 1.6.x series differs from the 1.4.x series by the relocation of the logback-access module to its own separate GitHub repository.

Here is a summary of 1.6.x dependencies:

Logback version	github branch	SLF4J version	JDK at runtime	JDK during build	Enterprise Edition (optional components)
1.6.x	master	2.0.x	11	17	Jakarta EE (jakarta.* namespace)

Configuration files using conditionals need to be migrated

In version 1.5.37 and subsequently in 1.6.x, support for Janino-based conditional expressions was removed. Evaluating arbitrary Java expressions with the Janino library had led to numerous security vulnerabilities.

If you are upgrading from a version earlier than 1.5.37 and your configuration files still use those older Janino-style conditionals, you must migrate them to the new format using the <condition> element (available since version 1.5.20).

The <condition> element accepts implementations of the PropertyCondition interface to decide whether a branch of the configuration should apply. Logback-core ships with several implementations of said interface. See the documentation on conditional processing for details.

If you prefer a more mechanical approach for the migration, the online migration service can provide a step-by-step process.

Legacy version: the 1.5.x series

The 1.5.x series is now considered legacy. Please note that the 1.6.x series is a direct descendant of and a drop-in replacement for the 1.5.x series. Thus, migration to version 1.6.x from 1.5.x should be straightforward. However, if you are migrating from version 1.5.36 or earlier and use conditionals in configuration files, you will need to migrate your logback.xml files. See the 1.6.x section above.

Older stale versions (END-OF-LIFE)

The 1.2.x series has reached END-OF-LIFE.
The 1.3.x series has reached END-OF-LIFE.
The 1.4.x series has reached END-OF-LIFE.

END-OF-LIFE status means that we have officially ceased active support for the indicated versions. This implies:

No further feature updates,
No bug fixes,
No security patches for newly discovered vulnerabilities.

Reproducible builds

Starting in early 2022, logback artifacts for versions 1.3.x and later are binary-reproducible, as independently attested by reproducible-central.

2026-10-29 Release of logback-tyler version 1.0.7

• The new tyler-maven-plugin translates a logback.xml file into a custom configurator at build time. The generated class is added to the compiled sources of the project and installed as a service provider in META-INF/services/ch.qos.logback.classic.spi.Configurator, so that logback-classic picks it up at runtime without parsing XML. The name of the configuration file and that of the generated class are configurable. Classes and resources of the project, including its dependencies, can be referenced by the configuration file. Please refer to the README file for details.

• The new Gradle plugin, with id ch.qos.logback.tyler, offers the same functionality for Gradle builds. Its generateTylerConfigurator task is cacheable and compatible with the configuration cache.

• The classes which may be loaded during translation are now governed by the new allowedPackages and allowAllPackages options of TranslationOptions. Classes in the ch.qos.logback package and its subpackages are always allowed. The restriction now applies to all classes loaded during translation, e.g. appenders, encoders, conditions, conversion rules, status listeners and nested components. Previously, it applied to nested components only, and with a fixed list of package prefixes. Packages are matched with respect to package boundaries. By default, the restriction is the same as in previous versions, while the Maven and Gradle plugins allow all packages unless instructed otherwise.

• The new classLoader option of TranslationOptions sets the class loader used to load classes mentioned in the configuration file and to resolve resources included with <include resource="...">. Previously, the class loader of logback was used.

• The new ConfigurationFileTranslator class translates a configuration file and collects the errors and warnings issued during translation.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 94d0741ccfda6544a84b2690db658c500616f992 associated with the tag v_1.0.7. Release built using Java "25.0.2" 2026-01-20 LTS build 25.0.2+10-LTS-69 under Linux Debian 13.4.

2026-10-28 Release of logback-tyler version 1.0.6

• As in JoranConfigurator, configuration now proceeds in two phases. Properties, conditions and other elements are processed first, in document order, followed by appenders, loggers and the root logger. Consequently, properties may be used before their definition, and appenders may be referenced before their declaration, including from other appenders, e.g. AsyncAppender. Conditions are evaluated once, at their position in the document. A cycle in appender references is reported as a translation error.

• The condition attribute of the <if> element is no longer supported. Use the <condition> element instead. Moreover, conditions declared with <condition> can now see properties local to the configurator. Previously, they failed with a NullPointerException at runtime.

• Generated code no longer fails to compile when appenders with the same name are declared in mutually exclusive branches, e.g. in <then> and <else> blocks. Such appenders share one field, while each appender element gets its own setup method. Appender fields are now declared as Appender<ILoggingEvent>.

• A reference to an appender that may not have been created, e.g. an appender declared in a branch not taken, is now skipped with a warning, as in JoranConfigurator. Previously, the generated configurator failed with an IllegalArgumentException. A reference to an undeclared appender is also reported at translation time.

• The packagingData attribute of the <configuration> element is now translated. The debug attribute and the logback.debug system property are now evaluated when the generated configurator runs, instead of at translation time. As for the scan attribute, values containing variables, e.g. packagingData="${PD:-false}", are evaluated when the generated configurator runs.

• Logger, appender and appender-ref names containing variables, e.g. <logger name="${loggerName}">, are now substituted when the generated configurator runs. Appender references are matched with appenders by their names as written in the configuration file.

• ModelToJava.extractModel(String) now passes its input to the XML parser as characters, ignoring any encoding declaration in the document. Previously, the input was encoded with the platform charset, which could garble non-ASCII characters. The new extractModel(InputSource) method accepts byte streams decoded according to the encoding declaration of the document.

• Custom elements whose children apply only if a condition holds, e.g. Spring Boot's <springProfile>, can now be translated by extending the new GuardModelHandler class.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit ee14819f837c891f24de33c9fa08ba842bb8a00d associated with the tag v_1.0.6. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-10-27 Release of logback-tyler version 1.0.5

• logback-tyler now requires Java 17 or later, down from Java 21. It still requires logback version 1.6.6 or later.

• Translation options are now grouped in the new immutable TranslationOptions class, passed to the ModelToJava constructor. They include the fully qualified name of the generated configurator class and its superclass. The superclass must extend TylerConfiguratorBase.

• When enabled in TranslationOptions, files referenced by <include> elements are read at translation time and their contents inlined in the generated code. Otherwise, or if an included file is unavailable, the element is omitted with a warning. Variables are not supported in the attributes of <include> elements.

• The <conversionRule> element is now translated.

• ModelToJava can now be subclassed to translate custom elements, by overriding the addModelHandlerAssociations and createJoranConfigurator methods. The ch.qos.logback.tyler.base.util package is now exported and module dependencies are declared transitive.

• Non-String properties whose values contain variables, e.g. <maxHistory>${MAX_HISTORY:-7}</maxHistory>, previously produced code that failed to compile. Such values are now converted when the generated configurator runs, with the same semantics and error messages as in JoranConfigurator. Literal values are converted at translation time. Invalid literal values and unsupported types are reported as translation errors. Moreover, translation of enum, float, long and Charset values has been fixed.

• Generated code no longer fails to compile when a logger is configured more than once, e.g. at top level and again within an <if> block, or when logger or appender names contain characters not allowed in Java identifiers, such as "-". Logger variables are now unique per declaration, and invalid characters are replaced with underscores.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 3f7f79d91c9a889435e03eafc68472ef77f41ce3 associated with the tag v_1.0.5. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-10-26 Release of logback-tyler version 1.0.4

• logback-tyler now requires logback version 1.6.6 or later.

• The scan attribute of the <configuration> element is now interpreted as in logback-classic. A value containing variables, e.g. scan="${SCAN:-true}", is evaluated when the generated configurator runs. A literal value is evaluated at translation time. Any non-empty value other than "false" enables scanning. If scanning is disabled, no scanning code is generated.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 320e7c71b027ad901f1ff4d6dda8f8a84ce6ceae associated with the tag v_1.0.4. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-10-25 Release of logback version 1.6.6

• LoggingEventVO now rejects, during deserialization, throwable proxies whose cause or suppressed entries point back into the graph of proxies, for example to their own parent. Such graphs cannot be produced by logback itself. However, a crafted stream sent to a socket receiver could use serialization back-references to build them, after which DefaultThrowableRenderer and SyslogAppender would loop forever and the recursive converters would overflow the stack. These streams are now rejected with an InvalidObjectException. Circular exceptions logged by the application are still transmitted correctly. This issue was reported and fixed in PR #1079 by arfa-21.

• FileNamePattern now escapes characters with a special meaning in regular expressions, such as (, [ or +, when converting the literal parts of a file name pattern into a regex. Previously, RollingFileAppender failed to start when the path contained an unbalanced parenthesis, as in C:/Users/Michael(Financ. This issue was reported in issues/914 by danamlund. Moreover, with SizeAndTimeBasedRollingPolicy and a pattern such as app.%d.(%i).log, existing archives were not recognized. After a restart within the same period, the next rollover could overwrite an existing archive, and maxHistory and totalSizeCap never removed such archives. This issue was reported in issues/933 by GeoffreyBoulay. The fix was contributed in PR #1077 by Jialin Chen. Regex metacharacters in %d{...} date patterns are now escaped as well.

• The conversion of date patterns into regular expressions now follows the rules of DateTimeFormatter, which logback uses to format dates, instead of those of SimpleDateFormat. In particular, the L (stand-alone month) pattern letter is now supported.

• SyslogOutputStream now connects its DatagramSocket to the syslog host. Previously, the socket was bound to the wildcard address, so that hardened environments saw an unconnected UDP listener on all interfaces for as long as the application ran. This issue was reported in issues/939 by joao-rebelo. The fix was contributed in PR #1076 by Lyin-OTTF.

If the socket cannot be connected, for example because the network is not yet available, SyslogOutputStream falls back to an unconnected socket and SyslogAppenderBase emits a warning. When a datagram sent on a connected socket fails due to an ICMP "port unreachable" message caused by an earlier datagram, the datagram is sent once more so that no message is lost. If the retry also fails, a single warning is emitted instead of one error per event.

• OutputStreamAppender now stops its encoder when the appender is stopped. Previously, encoders holding resources until they were stopped, such as those of logstash-logback-encoder, were never released, causing heap growth at each reconfiguration. This issue was fixed in PR #1072 by Samuel Fernandes.

• During variable substitution, an unmatched right curly brace now causes an error to be reported, with the original value left unchanged. Previously, the brace and all subsequent characters were silently dropped, so that %m}some text became %m. This issue was reported in issues/836 by philsttr.

• LogbackMDCAdapter now stores MDC entries in a LinkedHashMap, so that the %X converter outputs them in insertion order. This issue was reported in LOGBACK-1337 and fixed by Craig P. Motlin.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit a9ee8019ee183e076ff5477957dbf90c4b04dd92 associated with the tag v_1.6.6. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-09-30 Release of logback version 1.6.5

• Fixed a vulnerability CVE-2026-104721 closely related to previously published CVE-2026-19880. The fix in version 1.6.3, which strips forward and backward slashes from MDC values, was insufficient. An MDC value could still contain relative path components such as .., variable references such as /, or characters that are special in file name patterns and email addresses. This latest vulnerability was found and reported by François Martin (GitHub: @martinfrancois, https://github.com/martinfrancois).

MDCBasedDiscriminator, used by SiftingAppender, now rejects MDC values instead of stripping characters from them. An MDC value is rejected if it is empty, if it is longer than 64 characters, if it contains the sequence .., or if it contains any of the following characters: / \ $ { } [ ] ( ) | ? * + % , @. When an MDC value is rejected, the discriminator returns the value of its DefaultValue property. A warning is emitted for each rejected value. These warnings are rate-limited.

• When compression is enabled, TimeBasedRollingPolicy and SizeAndTimeBasedRollingPolicy now also remove old log files that were never compressed, for example because the application was not running at rollover time. Previously, such files were ignored by maxHistory and accumulated indefinitely. This issue was discussed in discussions/1032. See TimeBasedRollingPolicy.

• SimpleInvocationGate, deprecated in version 1.6.3, is now marked for removal. Use FixedIntervalInvocationGate instead.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit d1b829dcdb9fd98511c64401beb1419a9c9384aa associated with the tag v_1.6.5. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-09-24 Release of logback version 1.6.4

• Variable substitution is again applied to the scan attribute of the <configuration> element. The scanning refactoring in version 1.5.27 had dropped substitution, so values such as ${logback.scan.enabled:-true} were no longer resolved. As before version 1.5.27, an unrecognized non-empty value turns scanning on. The same substitution now applies to the scan attribute of <propertiesConfigurator>. This regression was reported in issues/1065 by vaibhavjain2. See automatic reconfiguration.

• OutputStreamAppender and FileAppender now handle stateful encoders. The Encoder interface has a new default method called isStateful(), which returns false. An encoder that keeps state between calls to encode() can return true. For such encoders, the appender holds its write lock while encoding and while writing, so the output of concurrent appends cannot interleave. Stateless encoders still encode outside the lock, so their performance does not change. Existing encoders need no changes.

• Several race conditions in OutputStreamAppender and FileAppender were fixed. The appender is now marked started and the encoder header is written while the same lock is held, so a concurrent append can no longer write an event before the header. After acquiring the lock, the appender checks again whether it has been stopped, so no event is written after the footer. In prudent mode, FileAppender now encodes and writes each event while holding the lock.

• Fixed a data race on the logger count in LoggerContext. Loggers are created under the lock of their parent logger, so loggers with different parents could be created at the same time and increments of the shared counter could be lost. As a result, LoggerContext.size() could return a value lower than the actual number of loggers. The counter is now an AtomicInteger. This issue was reported in issues/1038 by hcantunc. The fix was contributed in PR #1055 by seonwoo_jung.

• TimeBasedRollingPolicy now supports half-day periods. Date patterns with the AM/PM marker, for example %d{yyyy-MM-dd-a}, used to be detected as daily and rolled over only at midnight. They now roll over at both 00:00 and 12:00. This issue was reported in issues/976 by shakthifuture. The fix was contributed in PR #1051 by seonwoo_jung. See TimeBasedRollingPolicy.

• If org.jline.jansi.AnsiConsole cannot be found on the class path, JansiConsoleAppender now emits warnings that explain how to add org.jline:jansi-core and then writes to the plain console stream. See codes.html#missingJlineJansi.

• The unused ch.qos.logback.classic.util.LogbackMDCAdapterSimple class was removed. LogbackMDCAdapter remains the default MDC adapter.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 07d291ca0d280bc5da934ec9ff5f1da634fd7937 associated with the tag v_1.6.4. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-08-14 Release of logback-access version 2.0.15

• Bumped logback-core dependency to version 1.6.3.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit a0dc617e6e3dc82128be5d37233b0d533f6176ec associated with the tag v_2.0.15. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-08-14 Release of logback version 1.6.3

• In relation to CVE-2026-19880, MDCBasedDiscriminator (used by SiftingAppender) now strips forward and backward slashes (/, \) from MDC values before they are used as discriminating keys. This prevents path segments from escaping into destinations controlled by an attacker. When sanitisation actually changes a value, a warning is emitted; the warning is rate-limited (a small batch, then a lull of about ten minutes).

• Colour console support is split out into a dedicated JansiConsoleAppender (ch.qos.logback.core.JansiConsoleAppender). It wraps stdout or stderr with Jansi so ANSI escape sequences (for example coloured patterns) render correctly on terminals that need it, notably Windows. Prefer this class over the older path described next. See the appenders documentation.

• The withJansi property on ConsoleAppender is deprecated. Existing configurations that still set <withJansi>true</withJansi> continue to work for compatibility, but new setups should use JansiConsoleAppender instead.

• ConsoleAppender no longer treats the process console as an exclusive resource: stopping it does not close System.out / System.err. JansiConsoleAppender pairs each AnsiConsole.systemInstall() with systemUninstall() on stop, so repeated start/stop cycles do not leave Jansi installed or tear down streams shared with the rest of the JVM. Related behaviour is covered by tests for issues/1063.

• Invocation throttling helpers were reworked: SimpleInvocationGate is renamed FixedIntervalInvocationGate, and BatchedFixedIntervalInvocationGate allows a short burst of invocations before applying a fixed lull. The sanitisation warning above uses the batched gate.

• The JPMS module-info for logback-core now exports the ch.qos.logback.core.property package, which had been missing from the module descriptor.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e8e824dede022a6d7208b36cfa875b0d1b7772f3 associated with the tag v_1.6.3. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-08-10 Release of logback version 1.6.2

• Configuration analysis now detects contradictory caller-data inclusion instructions. For example, an AsyncAppender, SocketAppender or SMTPAppender with includeCallerData left at the default false is incompatible with a layout or encoder pattern that uses a caller-data converter such as %C, %M, %L, %F, %l or %caller. At runtime those converters would print question marks and still incur extraction cost on a worker thread. Logback now emits a configuration-time warning when such instructions disagree. See codes.html#callerContradiction for details. This issue was reported in issues/1059 by leeychee. The initial analysis was contributed by seonwoo_jung.

• Caller-contradiction analysis can be turned off by setting the logback.skipCallerContradictionAnalysis variable to true, either as a system property (-Dlogback.skipCallerContradictionAnalysis=true) or as a property in the configuration file:

<property name="logback.skipCallerContradictionAnalysis" value="true"/>

• SimpleSocketServer and SimpleSSLSocketServer now require an explicit client IP whitelist. On the command line, pass one or more allowed addresses (single IPs or CIDR ranges) after the configuration file. An empty whitelist means no clients are accepted. When embedding the server programmatically, register allowed addresses with addAllowedClientAddress(String) or setAllowedClientAddresses(Collection) before clients connect. See the documentation on restricting client access.

• Added ThrowableProxyVOBuilder for assembling a ThrowableProxyVO field by field, with a corresponding ThrowableProxyVO.builder() entry point.

• Dependency analysis handlers now run their postHandle method after child models have been processed, so checks that depend on nested appenders (such as caller-contradiction analysis) see a complete picture.

• Updated several dependencies, including Angus Mail to 2.0.4 and Jetty (test) to 12.1.12.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e3d78330ad1ba024fd987fd00c3ffb9cfcdb07dc associated with the tag v_1.6.2. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-07-28 Release of logback version 1.6.1

• In TimeBasedRollingPolicy, when the file option is set, the intermediate file renamed before asynchronous compression now receives the target archive name without the compression suffix (e.g. `.gz`, `.zip`, `.xz`). Previously it used a nanotime-based `.tmp` suffix. This makes the file easier to identify if compression fails during rollover. (See also the following paragraph.)

• On GZ, ZIP, or XZ compression failure, the original (uncompressed) log file is no longer deleted. Compression strategies now delete the source file only after successful compression and emit a warning that the original was left intact.

• ConsoleAppender with <withJansi> now probes JLine's org.jline.jansi.AnsiConsole first and falls back to the legacy FuseSource org.fusesource.jansi.AnsiConsole class. This keeps ANSI coloring working after Jansi moved under the JLine project. The optional org.jline:jansi-core artifact is declared as a dependency alongside the existing FuseSource jansi dependency. A preferredJansiClassName property was added for tests. This issue was reported in issues/1043 by seonwoo_jung who also provided the relevant PR.

• LayoutWrappingEncoder now reports an error at start() when no layout is set and guards encode() against a null layout. Previously, a missing layout (for example after an ignored <if>/<then>/<else> branch) allowed the encoder to start and then fail with a NullPointerException on every event, resulting in silent log loss. This issue was reported in issues/1046 by seonwoo_jung who also provided the relevant PR.

• FileCollisionAnalyser now detects file collisions involving nested appenders of SiftingAppender. When the nested file or fileNamePattern does not textually reference the discriminator key (e.g. ${userId}), a warning is issued at configuration time naming the appender, the key, and the shared target. This closes a gap where statically declared file appenders were checked but sifted nested appenders were not. This enhancement was contributed in PR #1041 by seonwoo_jung.

• More defensive handling in SyslogOutputStream and SyslogAppenderBase: the close() method now ensures that resources are closed, writes and flushes check that the underlying resources are in a valid state and fallback to no-op otherwise.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 57759f433000a133088ef0441038963134437fbd associated with the tag v_1.6.1. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-07-23 Release of logback-access version 2.0.14

• Bumped logback-core dependency to version 1.6.0.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 889b875e24e8d369aa32e34112e040abe15bbc81 associated with the tag v_2.0.14. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-07-23 Release of logback version 1.6.0

• Removed deprecated variables, methods, and classes. For the full list, see release_1.6.0.txt.

• In AsyncAppenderBase, the put(ILoggingEvent) method now has the protected modifier, which allows access from subclasses. This change was requested by Thomas Skjølberg in PR #1053.

• Bumped the SLF4J dependency to version 2.0.18.

• See also the overview of the 1.6.x series.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit b07adf36019b51a10f824fdd94009985c587b1d3 associated with the tag v_1.6.0. The release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-07-09 Release of logback-access version 2.0.13

• Bumped logback-core dependency to version 1.5.38. This fixes logback-access/issues/37.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 4604f5ef79bdc5a621bf7391d2b58a271d2b4eee associated with the tag v_2.0.13. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-07-09 Release of logback version 1.5.38

• In HardenedObjectInputStream, fixed a typo preventing Throwable objects from being white-filtered. This issue was reported in PR #1045 by t0rchwo0d.

• A bitwise identical binary of this version can be reproduced by building from source code at commit d04984a41fce42977466f45a2f076f0ee5cc4207 associated with the tag v_1.5.38. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-06-26 Release of logback version 1.5.37

This version is the definitive fix for CVE-2026-13006. Moreover, due to numerous past vulnerabilities, support for conditional expressions using Janino has been removed. The <condition> element provides similar functionality. Alternatively, there is an online migration service.

• This version is the definitive fix for CVE-2026-13006.

Due to the numerous vulnerabilities associated with conditional configuration processing based on the evaluation of Java expressions using the Janino library, support for conditional expressions using Janino has been removed.

Users are offered the an online migration service in addition to the <condition> element introduced in version 1.5.20, which provides a similar functionality. See the relevant documentation for more details.

• A bitwise identical binary of this version can be reproduced by building from source code at commit c1df7f522e648eec7b4ef6a12c8758fec0f00048 associated with the tag v_1.5.37. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-06-25 Release of logback version 1.5.36

• The 'condition' attribute in <if> elements now reject certain references that are associated with ACE attacks. This issue was reported by "yulate" (yulate531@gmail.com.com) and registered as CVE-2026-13006. Please note that the version 1.5.37 provides the full fix to this vulnerability.

• A bitwise identical binary of this version can be reproduced by building from source code at commit 9b94c37562bf25a6a944146701d42ee6c4eee888 associated with the tag v_1.5.36. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-06-23 Release of logback version 1.5.35

• The 'condition' attribute in <if> elements now rejects unicode escape sequences (\u and \U). This closes a bypass of the existing prohibition on the new operator in Janino-evaluated conditions. This issue was reported by IcySun (icysun@qq.com) and registered as CVE-2026-13006. Please note that the version 1.5.37 provides the full fix to this vulnerability.

• Added ConfiguratorRank.AUTHENTICATING (rank 100), the highest configurator rank, for certified/authenticating configurators discovered via the ServiceLoader mechanism. ContextInitializer now requires that at most one such configurator exist on the classpath; if more than one is found, initialization aborts with an error.

• ConsoleCharsetPropertyDefiner is no longer shipped. The Java 21 multi-release compilation of logback-core has been disabled, which removes this class from the published artifact. Configurations that referenced ch.qos.logback.core.property.ConsoleCharsetPropertyDefiner will need an alternative approach for console charset detection.

• The logback-examples module is now included in the set of artifacts published to Maven Central.

• JoranConfigurator.makeAnotherInstance() and DefaultJoranConfigurator.performMultiStepConfigurationFileSearch() are now protected, allowing derived configurators to override these methods.

• A bitwise identical binary of this version can be reproduced by building from source code at commit 08bd1598d565d83444f72983935e7da4746783b7 associated with the tag v_1.5.35. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-06-01 Release of logback version 1.5.34

• In case certain StackTraceElement values returned by the Throwable.getStackTrace method are null, StackTraceElementProxy substitutes a dummy instance instead of throwing an IllegalArgumentException. This resolves issues #1040, reported by Naotsugu Kobayashi.

• HardenedObjectInputStream will now throw an InvalidClassException during deserialization attempts of Proxy classes. This change addresses potential deserialization whitelist bypass vulnerability reported by York Shen and registered as CVE-2026-10532.

• A bitwise identical binary of this version can be reproduced by building from source code at commit e62272ac152469aec1ede056c3c7d0d7314e7bfe associated with the tag v_1.5.34. This release was built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-05-27 Release of logback version 1.5.33

• PropertiesConfiguratorModelHandler now registers properties file URLs to the ConfigurationWatchList when scan is enabled (via local scan="true" attribute or top-level configuration scan), ensuring changes are detected and reconfiguration occurs. This problem was reported in issues/1034.

• When processing <conversionRule> elements and both class and converterClass attributes are specified, silently use the class attribute without issuing a warning. However, if the attribute values differ, a warning will be issued. This change was requested in issues/1031.

• HardenedModelInputStream will no longer accept to deserialize all classes located under the "java.lang" and "java.util" packages but only a limited number of explicitly authorized classes in those packages. This potential deserialization whitelist bypass vulnerability was reported by York Shen and registered as CVE-2026-9828.

• SSL parameters for SSLSocketAppender now enable hostname verification by default. Moreover, the default protocol is now "TLSv1.2". This potential vulnerability was reported by York Shen.

• When printing the status message field, ViewStatusMessagesServletBase now escapes special characters such as "&" as character entities. This potential vulnerability was reported by York Shen.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 124e8b49b55ac34d08743a0646bd463410192647 associated with the tag v_1.5.33. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-05-19 Release of logback-scoped-mdc version 1.0.0-rc0

• Initial release candidate of logback-scoped-mdc module. This module offers ScopedValue-based MDC for logback-classic. It is designed for virtual threads and structured concurrency on Java 25+. Contributed by Filip Egeric.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 49ed8c3375d8f47579a6f064b3aff0084a7991c5 associated with the tag v_1.0.0-rc0. Release built using Java "25" 2026-01-20 LTS build 25.0.2+10-LTS-69 under Linux Debian 11.6.

2026-03-17 Release of logback-db version 1.5.32

• All logback-db modules now require JDK 11.

• All logback-db modules now depend on logback-core version 1.5.32.

• The logback-db-access module now depends on logback-access-common version 2.0.12.

• The logback-db-access module now dependes on jakarta.servlet version 6.0.0 instead of javax.servlet.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit f892ba56dcd9c0aa6493b6770fa7a0ce4092d994 associated with the tag v_1.5.32. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-02-16 Release of logback-access version 2.0.12

• Bumped logback-core dependency to version 1.5.32. This fixes logback-access/issues/34.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 1c9905623cef1c883f0b1e52aea6e47583f6d97b associated with the tag v_2.0.12. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-02-16 Release of logback version 1.5.32

• In DefaultProcessor, fixed incorrect check for dependencies contained within a parent model. Previous only the direct children were scanned. This fixes logback-access/issues/34.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e807335a67535b4eacce94e942c0bcb649665d93 associated with the tag v_1.5.32. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-02-14 Release of logback-access version 2.0.11

• Bumped logback-core dependency to version 1.5.31.

• Fixed incorrect version information in logback-access-tomcat module.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 853d5641a4d0014d02502edeb34339d88dda6e69 associated with the tag v_2.0.11. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-02-14 Release of logback version 1.5.31

• Fixed missing META-INF/services directory in logback-classic.jar. This issue rendered logback-classic version 1.5.30 unusable with SLF4J.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 168e42f9f9a18a3ffdf31eb2bfe80a71e33ecd8b associated with the tag v_1.5.31. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-02-14 Release of logback-access version 2.0.10

• Bumped logback-core dependency to version 1.5.30.

• Version checking code updated to conform to the standard defined in logback-core 1.5.30.

• Updated license to Eclipse Public License version 2.0 from version 1.0, retaining the GPL 2.1 dual-license.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit c0b6a4d9287e18b4065ee3c8e25954155e355f90 associated with the tag v_2.0.10. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-02-14 Release of logback version 1.5.30

• In this version, logback-classic.jar was missing the META-INF/services directory, making it unsuable with SLF4J. Version 1.5.31 (released later on the same day) fixes this issue.

• Fix scanning issue when an included file becomes available at a later time. This problem was reported in issues/1021 by Sergey Nazarov.

• Standardized code for version checking across modules.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 44164f10ca3fb44ce0e68519f13564b87e3aca61 associated with the tag v_1.5.30. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-02-09 Release of logback version 1.5.29

• In response to issues/1017, appender names and appender references are once again subject to variable substitution, reverting the change introduced in version 1.5.29.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 5db1146b85a4547e9189834e189042b82a97694b associated with the tag v_1.5.28. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-02-06 Release of logback version 1.5.28

• Appender names or appender references are no longer subject to variable substitution.

• Fixed issue with configurations with conditionals encompassing appenders. This was reported in issues/1016 reported by Sergey Sazonov.

• The <propertyConfigurator> element now admits a 'scan' attribute which can be used to override the 'scan' attribute in the <configuration> element.

• Fixed NullPointerException thrown by VersionUtil.checkForVersionEquality method occurring with GraalVM Native Images. This issue was reported in issues/1014.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e7a1855ab562bb102333f754603ff89359bf3cfc associated with the tag v_1.5.28. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-01-30 Release of logback version 1.5.27

• Updated license to Eclipse Public License version 2.0 from version 1.0, retaining the GPL 2.1 dual-license.

• Fixed missing MDC data transmitted by SocketAppender reported in issues/1010 by Lars Vogel.

• Removed all Receiver classes and components which were already disabled for several years.

• Refactored file scanning code for improved clarity.

• In SizeAndTimeBasedRollingPolicy modified totalSizeCap and maxFileSize comparison to taking into account file compression. This fixes issues/1007.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 3618eb01aad6672f9cd250dccf7546a69cbe982f associated with the tag v_1.5.27. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-01-25 Release of logback-access version 2.0.9

• Bumped logback-core dependency to version 1.5.26.

• Fixed missing AppenderModel to AppenderDeclarationAnalyser link in ModelClassToModelHandlerLinker. This issue was reported in issues/33 by Alexander Schepp.

• Aligned version check code with the functionality available in logback-core 1.5.26.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 42fd491ce26dbf27a81066012361d6d782d4fa5c associated with the tag v_2.0.9. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-01-25 Release of logback version 1.5.26

• InsertFromJNDIModelHandler was accessing javax.naming package forcing the inclusion of the optional java.naming module. This problem was raised in issues/1003 by Marius Hanl who also provided the relevant PR.

• In applications using shadow/fat/shade jars, module or package information could be lost. Thus, in the absence of version information, logback-classic would warn about version mismatches. Logback components now ship with properties files containing version information that survive shadow/fat/shade jars. This issue was reported in issues/1002 by Christoph Gritschenberger.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 33deb54506bbfaf1ff151f26f3a5f86936011619 associated with the tag v_1.5.26. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-01-17 Release of logback version 1.5.25

• When processing configuration files, logback-core will now only instantiate components compatible with the class expected by the encapsulating class. This fixes an ACE vulnerability recorded as CVE-2026-1225.

• In configuration files, referencing a single undeclared appender would cause all referenced appenders to be skipped. This issue was discovered in issues/997.

• Added VersionUtil class to logback-core. This utility class checks for version compatibility issues and alerts the user if need be.

• Added EpochConverter to output milliseconds/seconds since epoch. This enhancement was requested by Duncan Jauncey in issues/1000 who also provided the relevant implementation PR.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit f426e0002800cfb507f393fcacffe0761a425220 associated with the tag v_1.5.25. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-01-08 Release of logback-access version 2.0.8

• Bumped logback-core dependency to version 1.5.24.

• File name collisions are now aligned with changes in logback-core 1.5.23. In other words, file name collisions are detected at configuration time by analyzing the configuration file and no longer at appender run time.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit cfc81112a20cf321413c598f33d84037845999bd associated with the tag v_2.0.8. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2026-01-06 Release of logback version 1.5.24

• Added ExpressionPropertyCondition a PropertyCondition that can evaluate boolean expressions similar to Java. See the relevant documentation for further details.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 62bc5fc245dd3a52f3dd45e232733f4cefb4806d associated with the tag v_1.5.24. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2025-12-21 Release of logback version 1.5.23

• In response to issues/959 file name collisions are detected at configuration time by analyzing the configuration file and no longer at run time. This avoids the ConcurrentModificationException reported in the issue.

• ZIP and XZ compression now use a BufferedOutputStream when writing to the compressed file. This issue was reported in issues/988.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 0bcc3feb54a6d99caac70969ee5f8334aad1fbaf associated with the tag v_1.5.23. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2025-12-11 Release of logback version 1.5.22

• In order to prevent involuntary information leakage, Logback will no longer output the value of a substituted variable if the variable name contains any of the case-insensitive strings "password", "secret" or "confidential". This issue was reported by Chintan Rohila in issues/986.

• Logback now takes the overridden toString() method of Throwable subclasses into account when printing stack traces. This issue was reported in LOGBACK-543 by Alvin Chee, with a fix provided in PR 404 by Brett Kail.

• Instead of limit-counting guard, Logback now uses a tumbling-window guard to rate limit internal error messages.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 572379aabd2f672b49593e4020696c624541e5b0 associated with the tag v_1.5.22. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2025-11-10 Release of logback version 1.5.21

• Invocations of turbo filters in isDebugEnabled, isInfoEnabled()... remain as they were, untouched. However, any installed instances of TurboFilter are now invoked also from within the log(LoggingEvent) method of Logger with the contents of the LoggingEvent, typically via the fluent API. This fixes issues/871.

• Removed reentry-guard in most sub-classes of UnsynchronizedAppenderBase where it was not needed.

• Initialization procedure has been simplified by removing the step instantiating a SerializedModelConfigurator. However, it is still possible to set up SerializedModelConfigurator as a custom configurator.

• JsonEncoder is now friendlier to derivation by sub-classes as requested in issues/979.

• Fixed XMLLayout thread safety issue reported in LOGBACK-427.

• Removed superfluous buffering in Zip, GZ and XZ compression code.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit fed6f37ffe3449e40f6a9fffe050936a33116bd1 associated with the tag v_1.5.21. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2025-10-29 Release of logback version 1.3.16

• Back-ported the fix that disallows the new operator in the 'condition' attribute of <if> elements in configuration files. This addresses an ACE vulnerability (CVE-2025-11226) by applying the fix from version 1.5.19 to the 1.3.x series.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit b91509f0a0bfc9f5f16606a8c738a70849bef8c7 associated with the tag v_1.3.16. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2025-10-29 Release of logback-access version 2.0.7

• Added support for multiple headers with the same name. This addition was proposed by Robert Elliot in PR 23.

• Bumped logback-core dependency to version 1.5.20.

• Bumped Tomcat 10 dependency to version 10.1.48 and Tomcat 11 dependency to version 11.0.13.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit da08a9649da67b2a13148060a438454da4c82a24 associated with the tag v_2.0.7. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2025-10-27 Release of logback-tyler version 1.0.3

• Added support for <condition> element in config files introduced in logback version 1.5.20. It follows that this version of logback-tyler requires logback-core version 1.5.20.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 2b899a39849712f4d9a71f7ffa2f21c205a45a8b associated with the tag v_1.0.3. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.d

2025-10-19 Release of logback version 1.5.20

• Due to potential vulnerabilities associated with dynamic, i.e. runtime, java code compilation and execution (using Janino), the 'condition' attribute within the <if> element is deprecated and will be removed in the near future.

An online migration service is provided to help with the transition.

The <condition> element, new in this version, admits custom PropertyEvaluator as a recommended alternative. See also the updated documentation on conditional configuration.

• Initialization procedure was incorrectly reported as having been simplified in this version, i.e. version 1.5.20 by removing the step instantiating a SerializedModelConfigurator. The actual simplification was done in version 1.5.21

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 930fb15c993a4344bcecc6ba2225c12a2c38e676 associated with the tag v_1.5.20. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2025-09-30 Release of logback version 1.5.19

• Disallow "new" operator in the condition attribute of <if> elements. This fixes an ACE vulnerability recorded as CVE-2025-11226.

• At initialization time, slightly better reporting about watched configuration files.

• Softer message regarding usage of ConsoleAppender and its potential impact on performance.

• In ViewStatusMessagesServlet, restrict processing of "Clear" button to POST method. This change was proposed by Ralf Wiebicke who also provided the relevant PR.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit e572d4f87f06674788eb3ca7148e8d1dffc615fa associated with the tag v_1.5.19. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2025-03-18 Release of logback version 1.5.18

• Added support for XZ compression for archived log files. Note that XZ compression requires Tukaani project's XZ library for Java. In case XZ compression is requested but the XZ library is missing, then logback will substitute GZ compression as a fallback. This feature was requested in issues/755.

• Removed references to java.security.AccessController class. This class has been deprecated for some time and is slated for removal in future JDK versions.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit b2a02f065379a9b1ba5ff837fc08913b744774bc associated with the tag v_1.5.18. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2025-02-25 Release of logback version 1.5.17

• Fixed Jansi 2.4.0 color-coded output not working on Windows CMD.exe console when the default terminal application is set to "Windows Console Host". This problem was reported in issues/753 by Michael Lyubkin.

• Fixed race condition occurring in case MDC class is initialized while org.slf4j.LoggerFactory is initializing logback-classic's LoggerContext. When this race conditions occurs, the MDCAdapter instance used by MDC would not match the instance used by logback-classic. This issue was reported in SLF4J issues/450. While logback-classic version 1.5.17 remains compatible with SLF4J versions in the 2.0.x series, fixing this particular MDC issue requires SLF4J version 2.0.17.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 10358724ed723b3745c010aa40cb02a2dfed4593 associated with the tag v_1.5.17. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2025-01-07 Release of logback-access version 2.0.6

• Added StubEventEvaluator as a default nested component rule for <evaluator>. Without this rule, configuration files previously defaulting to JaninoEventEvaluator would raise exceptions.

• Added RequestURIEventEvaluator and StatusCodeEventEvaluator as sample evaluators.

• Bumped logback-core dependency to version 1.5.16.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit d580d904bec59338ee5fe57985e6ba62418f982c associated with the tag v_2.0.6. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

2025-01-05 Release of logback version 1.5.16

• In order to ease the migration of configuration files depending on JaninoEventEvaluator, logback-classic will emit a warning about the removal of JaninoEventEvaluator in version 1.5.13 and suggest an online migration tool.

• A bit-wise identical binary of this version can be reproduced by building from source code at commit 74c9ebd0e784d9e9ffc6c627cf5016d0157956b2 associated with the tag v_1.5.16. Release built using Java "21" 2023-10-17 LTS build 21.0.1.+12-LTS-29 under Linux Debian 11.6.

For release notes of versions published before 2025, see the news archive.