Logback isn’t entirely immune: https://cve.report/CVE-2021-42550, although access to the configuration file is required.