CVE-2026-40023
Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters
Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.
Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters
Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.
Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.
- Record
CVE-2026-40023- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
EUVDEUVD-2026-21490
Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.
Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.
- Record
EUVD-2026-21490- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q8qr-wp2r-738r
Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0...
Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.
Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.
- Record
GHSA-q8qr-wp2r-738r- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
NVD
Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.
Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.
- Record
CVE-2026-40023- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSV
Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters
Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.
Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.
- Record
CVE-2026-40023- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-40023
Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.
- Record
DEBIAN-CVE-2026-40023- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2026-40023
Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.
- Record
UBUNTU-CVE-2026-40023- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2026-0218 No score
Updated log4cxx packages fix security vulnerability
CVE-2026-40023, Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters
- Record
MGASA-2026-0218- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10566-1 No score
liblog4cxx-devel-1.7.0-2.1 on GA media
These are all security issues fixed in the liblog4cxx-devel-1.7.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10566-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:20705-1 No score
Security update for log4cxx
This update for log4cxx fixes the following issues:
Changes in log4cxx:
-
update to 1.7.0 (bsc#1261994, CVE-2026-40023):
- Non-ascii characters incorrectly encoded in JSON output [#615]
- XML output could contain characters not allowed by the XML 1.0 specification
- An XML configuration file with recursive references caused program termination [#605]
- Possible undefined behavior during a configuration change
- Message loss when the calculation of a logged value also logs
- ODBCAppender prepared statement value buffers had incorrect lifetimes [#581]
-
update to 1.6.0:
- Configuration ${varname} values can be set programatically prior to loading a configuration file (see com/foo/config4.cpp) [#520]
- The current executable's file name and its components are available for use in a configuration file and the LOG4CXX_CONFIGURATION environment variable (see log4cxx::spi::Configurator::properties). [#520]
- Console output (Log4cxx internal logging and BasicConfigurator) use a color per message level by default [#529]
- New logging macros that defer binary-to-text conversion until used in AsyncAppender's background thread
- A simplified way to attach an AsyncAppender to a logger using a configuration file [#550]
- Record
openSUSE-SU-2026:20705-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
log4cxxDebian:12 |
All versions, plus listed versions 1.0.0-11.0.0-1+deb12u11.1.0-11.1.0-1~exp11.2.0-1 Show 5 moreShow less1.3.0-11.3.1-11.4.0-11.4.0-1.11.5.0-1 |
None known |
log4cxxDebian:13 |
All versions, plus listed versions 1.4.0-11.4.0-1+deb13u11.4.0-1.11.5.0-1 |
None known |
log4cxxDebian:14 |
All versions, plus listed versions 1.4.0-11.4.0-1.11.5.0-1 |
None known |
log4cxxMageia:9 |
before 1.1.0-1.1.mga9 | 1.1.0-1.1.mga9 |
log4cxxUbuntu:14.04:LTS |
All versions, plus listed versions 0.10.0-1.2ubuntu3 |
None known |
log4cxxUbuntu:16.04:LTS |
All versions, plus listed versions 0.10.0-9ubuntu10.10.0-9ubuntu20.10.0-10ubuntu1 |
None known |
log4cxxUbuntu:18.04:LTS |
All versions, plus listed versions 0.10.0-12ubuntu10.10.0-13ubuntu10.10.0-13ubuntu2 |
None known |
log4cxxUbuntu:20.04:LTS |
All versions, plus listed versions 0.10.0-15ubuntu10.10.0-15ubuntu2 |
None known |
log4cxxUbuntu:22.04:LTS |
All versions, plus listed versions 0.11.0-2ubuntu10.11.0-3ubuntu20.12.1-4 |
None known |
log4cxxUbuntu:24.04:LTS |
All versions, plus listed versions 1.1.0-11.1.0-1build11.1.0-1build21.1.0-1build3 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
log4cxxUbuntu:25.10 |
All versions, plus listed versions 1.3.1-11.4.0-1 |
None known |
log4cxxUbuntu:26.10 |
All versions, plus listed versions 1.5.0-1 |
None known |
log4cxxUbuntu:26.04:LTS |
All versions, plus listed versions 1.4.0-11.5.0-1 |
None known |
log4cxxopenSUSE:Tumbleweed |
before 1.7.0-2.1 | 1.7.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40023 is a medium vulnerability (CVSS 6.3) in Apache Log4cxx, published April 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in log4cxx 1.1.0-1.1.mga9.
References
github.com/apache/logging-log4cxx/pull/609
logging.apache.org/security.html
lists.apache.org/thread/y15cv3zblg3dfwr5vy6ddbnl4zyrzr8b
openwall.com/lists/oss-security/2026/04/10/12
Show 13 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-40023
brew.sh
conan.io/center
security-tracker.debian.org/tracker/CVE-2026-40023
advisories.mageia.org/MGASA-2026-0218.html
bugs.mageia.org/show_bug.cgi?id=35352
lists.opensuse.org/archives/list/[email protected]/message/A7IXK4LCNBBYY5YSNHODMPEG64MYK6VE
ubuntu.com/security/CVE-2026-40023
cve.org/CVERecord?id=CVE-2026-40023
suse.com/security/cve/CVE-2026-40023
bugzilla.suse.com/1261994