Log in Start free

Vulnerability · Published Apr 10, 2026 · Assigned by apache

CVE-2026-34480Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

Medium 6.9

In plain English

A medium-severity security flaw in Apache Log4j Core from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)1.0%top 35.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use: * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records. * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12apache-log4j1.2no fix listedDEBIAN-CVE-2026-34480
Debian:13apache-log4j1.2no fix listedDEBIAN-CVE-2026-34480
Debian:14apache-log4j1.2no fix listedDEBIAN-CVE-2026-34480
Debian:12apache-log4j2no fix listedDEBIAN-CVE-2026-34480
Debian:13apache-log4j2no fix listedDEBIAN-CVE-2026-34480
Debian:14apache-log4j2no fix listedDEBIAN-CVE-2026-34480
Mavenorg.apache.logging.log4j:log4j-core2.25.4GHSA-3pxv-7cmr-fjr4
Mavenorg.apache.logging.log4j:log4j-coreno fix listedGHSA-3pxv-7cmr-fjr4
Ubuntu:22.04:LTSapache-log4j1.2no fix listedUBUNTU-CVE-2026-34480
Ubuntu:24.04:LTSapache-log4j1.2no fix listedUBUNTU-CVE-2026-34480
Ubuntu:25.10apache-log4j1.2no fix listedUBUNTU-CVE-2026-34480
Ubuntu:26.04:LTSapache-log4j1.2no fix listedUBUNTU-CVE-2026-34480
Ubuntu:26.10apache-log4j1.2no fix listedUBUNTU-CVE-2026-34480
Ubuntu:22.04:LTSapache-log4j2no fix listedUBUNTU-CVE-2026-34480
Ubuntu:24.04:LTSapache-log4j2no fix listedUBUNTU-CVE-2026-34480
Ubuntu:25.10apache-log4j2no fix listedUBUNTU-CVE-2026-34480
Ubuntu:26.04:LTSapache-log4j2no fix listedUBUNTU-CVE-2026-34480
Ubuntu:26.10apache-log4j2no fix listedUBUNTU-CVE-2026-34480

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Log4j Core 2.0-alpha1 – before 2.25.43.0.0-alpha1 – through 3.0.0-beta3

Weakness: CWE-116 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

References