CVE-2026-34477
Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass
The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element.
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
- An SMTP, Socket, or Syslog appender is in use.
- TLS is configured via a nested <Ssl> element.
- The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass
The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element.
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
- An SMTP, Socket, or Syslog appender is in use.
- TLS is configured via a nested <Ssl> element.
- The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
- Record
CVE-2026-34477- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-297
- Updated
- 2026-11-02
EUVDEUVD-2026-21407
The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element.
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
- An SMTP, Socket, or Syslog appender is in use.
- TLS is configured via a nested <Ssl> element.
- The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
- Record
EUVD-2026-21407- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6hg6-v5c8-fphq
Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration
The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName attribute of the <Ssl> element.
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
- An SMTP, Socket, or Syslog appender is in use.
- TLS is configured via a nested <Ssl> element.
- The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
This issue does not affect users of the HTTP appender, which uses a separate verifyHostname attribute that was not subject to this bug and verifies host names by default.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
- Record
GHSA-6hg6-v5c8-fphq- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-297
- Updated
- 2026-11-02
NVD
The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element.
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
- An SMTP, Socket, or Syslog appender is in use.
- TLS is configured via a nested <Ssl> element.
- The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
- Record
CVE-2026-34477- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-297, CWE-295
- Updated
- 2026-11-02
OSV
Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass
The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element.
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
- An SMTP, Socket, or Syslog appender is in use.
- TLS is configured via a nested <Ssl> element.
- The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
- Record
CVE-2026-34477- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-297
- Updated
- 2026-11-02
OSVGHSA-6hg6-v5c8-fphq
Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration
The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName attribute of the <Ssl> element.
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
- An SMTP, Socket, or Syslog appender is in use.
- TLS is configured via a nested <Ssl> element.
- The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
This issue does not affect users of the HTTP appender, which uses a separate verifyHostname attribute that was not subject to this bug and verifies host names by default.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
- Record
GHSA-6hg6-v5c8-fphq- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-297
- Updated
- 2026-11-02
Show 16 moreShow less
OSVRHLW-2026-64cfac683d7a9af7
Lightwell Security Advisory: log4j-1.2-api 2.24.3.rhlw-00004
Red Hat Lightwell has released org.apache.logging.log4j:log4j-1.2-api 2.24.3.rhlw-00004 with backported fixes for CVE-2025-68161, CVE-2026-34477, CVE-2026-34478, and CVE-2026-34480.
CVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender
CVE-2026-34477: Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass
CVE-2026-34478: Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility
CVE-2026-34480: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
This patched artifact is a drop-in replacement for org.apache.logging.log4j:log4j-1.2-api 2.24.3 from Maven Central.
- Record
RHLW-2026-64cfac683d7a9af7- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-97a6348484d7bbf1
Lightwell Security Advisory: log4j-core 2.24.3.rhlw-00004
Red Hat Lightwell has released org.apache.logging.log4j:log4j-core 2.24.3.rhlw-00004 with backported fixes for CVE-2025-68161, CVE-2026-34477, CVE-2026-34478, and CVE-2026-34480.
CVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender
CVE-2026-34477: Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass
CVE-2026-34478: Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility
CVE-2026-34480: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
This patched artifact is a drop-in replacement for org.apache.logging.log4j:log4j-core 2.24.3 from Maven Central.
- Record
RHLW-2026-97a6348484d7bbf1- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-34477
CVE-2026-34477 in org.apache.logging.log4j:log4j-core - Patched by Root
Root has patched CVE-2026-34477 in the org.apache.logging.log4j:log4j-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-34477- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-34477
The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element. Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value. A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met: * An SMTP, Socket, or Syslog appender is in use. * TLS is configured via a nested <Ssl> element. * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
- Record
UBUNTU-CVE-2026-34477- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1779929356 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.17.1-tuxcare.2.
- Record
CLSA-2026-1779929356- Updated
- 2026-11-02
OSVCLSA-2026-1785727932 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.17.2-tuxcare.2.
- Record
CLSA-2026-1785727932- Updated
- 2026-11-02
OSVCLSA-2026-1787726168 No score
TuxCare security update for org.apache.logging.log4j (4 CVEs)
TuxCare rebuilt 3 org.apache.logging.log4j packages to address 4 CVEs. Fixed in 2.24.3-tuxcare.2.
- Record
CLSA-2026-1787726168- Updated
- 2026-11-02
OSVCLSA-2026-1790872639 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.13.3-tuxcare.1.
- Record
CLSA-2026-1790872639- Updated
- 2026-11-02
OSVCLSA-2026-1791375236 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (3 CVEs)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 3 CVEs. Fixed in 2.23.1-tuxcare.2.
- Record
CLSA-2026-1791375236- Updated
- 2026-11-02
OSVCLSA-2026-1791819410 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.18.0-tuxcare.2.
- Record
CLSA-2026-1791819410- Updated
- 2026-11-02
OSVCLSA-2026-1791901346 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.19.0-tuxcare.2.
- Record
CLSA-2026-1791901346- Updated
- 2026-11-02
OSVCLSA-2026-1792696729 No score
TuxCare security update for org.apache.logging.log4j (5 CVEs)
TuxCare rebuilt 4 org.apache.logging.log4j packages to address 5 CVEs. Fixed in 2.20.0-tuxcare.2.
- Record
CLSA-2026-1792696729- Updated
- 2026-11-02
OSVCLSA-2026-1792756951 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.12.4-tuxcare.2.
- Record
CLSA-2026-1792756951- Updated
- 2026-11-02
OSVCLSA-2026-1793354113 No score
TuxCare security update for org.apache.logging.log4j (5 CVEs)
TuxCare rebuilt 3 org.apache.logging.log4j packages to address 5 CVEs. Fixed in 2.25.2-tuxcare.1.
- Record
CLSA-2026-1793354113- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10544-1 No score
log4j-2.20.0-2.1 on GA media
These are all security issues fixed in the log4j-2.20.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10544-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1843-1 No score
Security update for log4j
This update for log4j fixes the following issues:
- CVE-2026-34477: TLS connections vulnerable to interception due to incomplete hostname verification configuration checks (bsc#1262050).
- CVE-2026-34479: silent log event loss due to improper XML escaping in
Log4j1XmlLayout(bsc#1262091). - CVE-2026-34480: silent log event loss due to improper XML escaping in
XmlLayout(bsc#1262092). - CVE-2026-34481: silent log event loss due to improper serialization of non-finite floating-point values in
JsonTemplateLayout(bsc#1262093).
- Record
SUSE-SU-2026:1843-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.logging.log4j:log4j-coreMaven |
2.12.0 up to 2.25.4 | 2.25.4 |
org.apache.logging.log4j:log4j-coreMaven |
3.0.0-alpha1 to 3.0.0-beta3 | None known |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.17.1 up to 2.17.1-tuxcare.2, plus listed versions 2.17.1-tuxcare.1 |
2.17.1-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.17.2 up to 2.17.2-tuxcare.2, plus listed versions 2.17.2-tuxcare.1 |
2.17.2-tuxcare.2 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 3 CVEs |
2.17.2 up to 2.17.2-tuxcare.2, plus listed versions 2.17.2-tuxcare.1 |
2.17.2-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 4 CVEs |
2.24.3 up to 2.24.3-tuxcare.2, plus listed versions 2.24.3-tuxcare.1 |
2.24.3-tuxcare.2 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven From an advisory covering 4 CVEs |
2.24.3 up to 2.24.3-tuxcare.2, plus listed versions 2.24.3-tuxcare.1 |
2.24.3-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 4 CVEs |
2.24.3 up to 2.24.3-tuxcare.2, plus listed versions 2.24.3-tuxcare.1 |
2.24.3-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.13.3 up to 2.13.3-tuxcare.1 | 2.13.3-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.13.3 up to 2.13.3-tuxcare.1 | 2.13.3-tuxcare.1 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.23.1 up to 2.23.1-tuxcare.2, plus listed versions 2.23.1-tuxcare.1 |
2.23.1-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.18.0 up to 2.18.0-tuxcare.2, plus listed versions 2.18.0-tuxcare.1 |
2.18.0-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.19.0 up to 2.19.0-tuxcare.2, plus listed versions 2.19.0-tuxcare.1 |
2.19.0-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 5 CVEs |
2.20.0 up to 2.20.0-tuxcare.2, plus listed versions 2.20.0-tuxcare.1 |
2.20.0-tuxcare.2 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven From an advisory covering 5 CVEs |
2.20.0 up to 2.20.0-tuxcare.2, plus listed versions 2.20.0-tuxcare.1 |
2.20.0-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 5 CVEs |
2.20.0 up to 2.20.0-tuxcare.2, plus listed versions 2.20.0-tuxcare.1 |
2.20.0-tuxcare.2 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 5 CVEs |
2.20.0 up to 2.20.0-tuxcare.2, plus listed versions 2.20.0-tuxcare.1 |
2.20.0-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.12.4 up to 2.12.4-tuxcare.2, plus listed versions 2.12.4-tuxcare.1 |
2.12.4-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.12.4 up to 2.12.4-tuxcare.2, plus listed versions 2.12.4-tuxcare.1 |
2.12.4-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 5 CVEs |
2.25.2 up to 2.25.2-tuxcare.1 | 2.25.2-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 5 CVEs |
2.25.2 up to 2.25.2-tuxcare.1 | 2.25.2-tuxcare.1 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 5 CVEs |
2.25.2 up to 2.25.2-tuxcare.1 | 2.25.2-tuxcare.1 |
org.apache.logging.log4j:log4j-coreMaven |
2.12.0 up to 2.25.4, plus listed versions 2.12.12.12.22.12.32.12.42.13.0 Show 27 moreShow less2.13.12.13.22.13.32.14.02.14.12.15.02.16.02.17.02.17.12.17.22.18.02.19.02.20.02.21.02.21.12.22.02.22.12.23.02.23.12.24.02.24.12.24.22.24.32.25.02.25.12.25.22.25.3 |
2.25.4 |
org.apache.logging.log4j:log4j-coreMaven |
3.0.0-alpha1 to 3.0.0-beta3, plus listed versions 3.0.0-beta13.0.0-beta2 |
None known |
org.apache.logging.log4j:log4j-1.2-apiRed Hat Lightwell:Maven From an advisory covering 4 CVEs |
before 2.24.3.rhlw-00004, plus listed versions 2.02.0-beta52.0-beta62.0-beta72.0-beta8 Show 45 moreShow less2.0-beta92.0-rc12.0-rc22.0.12.0.22.12.10.02.11.02.11.12.11.22.12.02.12.12.12.22.12.32.12.42.13.02.13.12.13.22.13.32.14.02.14.12.15.02.16.02.17.02.17.12.17.22.18.02.19.02.22.20.02.21.02.21.12.22.02.22.12.23.02.23.12.24.02.24.12.24.22.24.32.32.3.12.3.22.42.4.1 |
2.24.3.rhlw-00004 |
org.apache.logging.log4j:log4j-coreRed Hat Lightwell:Maven From an advisory covering 4 CVEs |
before 2.24.3.rhlw-00004, plus listed versions 2.02.0-alpha12.0-alpha22.0-beta12.0-beta2 Show 45 moreShow less2.0-beta32.0-beta42.0-beta52.0-beta62.0-beta72.0-beta82.0-beta92.0-rc12.0-rc22.0.12.0.22.12.10.02.11.02.11.12.11.22.12.02.12.12.12.22.12.32.12.42.13.02.13.12.13.22.13.32.14.02.14.12.15.02.16.02.17.02.17.12.17.22.18.02.19.02.22.20.02.21.02.21.12.22.02.22.12.23.02.23.12.24.02.24.12.24.2 |
2.24.3.rhlw-00004 |
org.apache.logging.log4j:log4j-coreRoot:Maven |
before 2.12.4-aikido.10 | 2.12.4-aikido.102.19.0-aikido.92.25.0-aikido.112.25.0-aikido.122.21.1-aikido.52.23.1-aikido.32.19.0-aikido.9306 |
io.root.org.apache.logging.log4j:log4j-coreRoot:Maven |
before 2.19.0-root.io.2 | 2.19.0-root.io.22.19.0-root.io.32.25.0-root.io.22.12.4-root.io.32.19.0-root.io.82.12.4-root.io.92.25.0-root.io.102.12.4-root.io.102.19.0-root.io.92.25.0-root.io.112.21.1-root.io.42.25.0-root.io.122.21.1-root.io.52.23.1-root.io.32.19.0-root.io.9306 |
apache-log4j2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.2-12.4-12.4-22.4-2ubuntu0.1~esm1 |
None known |
apache-log4j2Ubuntu:18.04:LTS |
All versions, plus listed versions 2.8.2-12.8.2-22.10.0-12.10.0-22.10.0-2ubuntu0.12.12.4-0ubuntu0.1 |
None known |
apache-log4j2Ubuntu:20.04:LTS |
All versions, plus listed versions 2.11.1-22.11.2-12.15.0-0.20.04.12.16.0-0.20.04.12.17.0-0.20.04.12.17.1-0.20.04.1 |
None known |
apache-log4j2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.13.3-12.15.0-12.16.0-12.17.0-12.17.1-1 |
None known |
apache-log4j2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.19.0-2 |
None known |
apache-log4j2Ubuntu:25.10 |
All versions, plus listed versions 2.19.0-2 |
None known |
apache-log4j2Ubuntu:26.10 |
All versions, plus listed versions 2.19.0-2build1 |
None known |
apache-log4j2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.19.0-22.19.0-2build1 |
None known |
log4jopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 2.20.0-2.1 | 2.20.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-34477 is a medium vulnerability (CVSS 6.3) in Apache Log4j, published April 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in org.apache.logging.log4j:log4j-core 2.25.4.
References
github.com/apache/logging-log4j2/pull/4075
logging.apache.org/security.html
lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4
nvd.nist.gov/vuln/detail/CVE-2026-34477
Show 32 moreShow less
repo.maven.apache.org/maven2
suse.com/support/update/announcement/2026/suse-su-20261843-1
bugzilla.suse.com/1262050
ubuntu.com/security/CVE-2026-34477
cve.org/CVERecord?id=CVE-2026-34477
Left out here: 26 versions. The JSON record has them.