[shartte]

I believe this is the default in Spring Boot. Logback is used by their starters (see https://docs.spring.io/spring-boot/docs/current/reference/ht...).

[zorr]

Yes, recent Spring-boot projects include log4j-to-slf4j, slf4j-api, logback-core and logback-classic which AFAIK are not vulnerable.