CVE-2026-34479
Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
Two groups of users are affected:
- Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.
- Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.
Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.
Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
Two groups of users are affected:
- Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.
- Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.
Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.
Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.
- Record
CVE-2026-34479- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
EUVDEUVD-2026-21409
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
Two groups of users are affected:
- Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.
- Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.
Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.
Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.
- Record
EUVD-2026-21409- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h383-gmxw-35v2
Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
Two groups of users are affected:
- Those using
Log4j1XmlLayoutdirectly in a Log4j Core 2 configuration file. - Those using the Log4j 1 configuration compatibility layer with
org.apache.log4j.xml.XMLLayoutspecified as the layout class.
Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.
[!NOTE] The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide, and specifically the section on eliminating reliance on the bridge.
- Record
GHSA-h383-gmxw-35v2- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
NVD
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
Two groups of users are affected:
- Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.
- Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.
Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.
Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.
- Record
CVE-2026-34479- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSV
Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
Two groups of users are affected:
- Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.
- Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.
Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.
Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.
- Record
CVE-2026-34479- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-34479
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.
- Record
DEBIAN-CVE-2026-34479- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 25 moreShow less
OSVGHSA-h383-gmxw-35v2
Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
Two groups of users are affected:
- Those using
Log4j1XmlLayoutdirectly in a Log4j Core 2 configuration file. - Those using the Log4j 1 configuration compatibility layer with
org.apache.log4j.xml.XMLLayoutspecified as the layout class.
Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.
[!NOTE] The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide, and specifically the section on eliminating reliance on the bridge.
- Record
GHSA-h383-gmxw-35v2- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-34479
CVE-2026-34479 in org.apache.logging.log4j:log4j-1.2-api - Patched by Root
Root has patched CVE-2026-34479 in the org.apache.logging.log4j:log4j-1.2-api package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-34479- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-34479
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.
- Record
UBUNTU-CVE-2026-34479- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1776991059 No score
TuxCare security update for org.apache.logging.log4j (2 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.17.2-tuxcare.1.
- Record
CLSA-2026-1776991059- Updated
- 2026-11-02
OSVCLSA-2026-1779124827 No score
log4j: Fix of CVE-2026-34479
- CVE-2026-34479: fix Log4j1XmlLayout invalid XML 1.0 character escape
- Record
CLSA-2026-1779124827- Updated
- 2026-11-02
OSVCLSA-2026-1780054786 No score
log4j: Fix of CVE-2026-34479
- CVE-2026-34479: fix Log4j1XmlLayout invalid XML 1.0 character escape
- Record
CLSA-2026-1780054786- Updated
- 2026-11-02
OSVCLSA-2026-1780447835 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 3 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.22.1-tuxcare.1.
- Record
CLSA-2026-1780447835- Updated
- 2026-11-02
OSVCLSA-2026-1787471222 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 4 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.23.1-tuxcare.1.
- Record
CLSA-2026-1787471222- Updated
- 2026-11-02
OSVCLSA-2026-1787726168 No score
TuxCare security update for org.apache.logging.log4j (4 CVEs)
TuxCare rebuilt 3 org.apache.logging.log4j packages to address 4 CVEs. Fixed in 2.24.3-tuxcare.2.
- Record
CLSA-2026-1787726168- Updated
- 2026-11-02
OSVCLSA-2026-1788442788 No score
TuxCare security update for org.apache.logging.log4j (2 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.17.1-tuxcare.4.
- Record
CLSA-2026-1788442788- Updated
- 2026-11-02
OSVCLSA-2026-1790709023 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 3 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.24.1-tuxcare.1.
- Record
CLSA-2026-1790709023- Updated
- 2026-11-02
OSVCLSA-2026-1790872639 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.13.3-tuxcare.1.
- Record
CLSA-2026-1790872639- Updated
- 2026-11-02
OSVCLSA-2026-1790941398 No score
TuxCare security update for org.apache.logging.log4j (1 CVE)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 1 CVE. Fixed in 2.11.1-tuxcare.1.
- Record
CLSA-2026-1790941398- Updated
- 2026-11-02
OSVCLSA-2026-1790944047 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 3 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.19.0-tuxcare.1.
- Record
CLSA-2026-1790944047- Updated
- 2026-11-02
OSVCLSA-2026-1792696729 No score
TuxCare security update for org.apache.logging.log4j (5 CVEs)
TuxCare rebuilt 4 org.apache.logging.log4j packages to address 5 CVEs. Fixed in 2.20.0-tuxcare.2.
- Record
CLSA-2026-1792696729- Updated
- 2026-11-02
OSVCLSA-2026-1792756951 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.12.4-tuxcare.2.
- Record
CLSA-2026-1792756951- Updated
- 2026-11-02
OSVCLSA-2026-1793052872 No score
TuxCare security update for org.apache.logging.log4j (4 CVEs)
TuxCare rebuilt 4 org.apache.logging.log4j packages to address 4 CVEs. Fixed in 2.21.1-tuxcare.1.
- Record
CLSA-2026-1793052872- Updated
- 2026-11-02
OSVCLSA-2026-1793354113 No score
TuxCare security update for org.apache.logging.log4j (5 CVEs)
TuxCare rebuilt 3 org.apache.logging.log4j packages to address 5 CVEs. Fixed in 2.25.2-tuxcare.1.
- Record
CLSA-2026-1793354113- Updated
- 2026-11-02
OSVCLSA-2026-1793723595 No score
TuxCare security update for org.apache.logging.log4j (1 CVE)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 1 CVE. Fixed in 2.8.2-tuxcare.2.
- Record
CLSA-2026-1793723595- Updated
- 2026-11-03
OSVCLSA-2026-1793724321 No score
TuxCare security update for org.apache.logging.log4j (1 CVE)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 1 CVE. Fixed in 2.9.1-tuxcare.2.
- Record
CLSA-2026-1793724321- Updated
- 2026-11-03
OSVCLSA-2026-1793724931 No score
TuxCare security update for org.apache.logging.log4j (1 CVE)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 1 CVE. Fixed in 2.7-tuxcare.2.
- Record
CLSA-2026-1793724931- Updated
- 2026-11-03
OSVCLSA-2026-1793725664 No score
TuxCare security update for org.apache.logging.log4j (2 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.10.0-tuxcare.2.
- Record
CLSA-2026-1793725664- Updated
- 2026-11-03
OSVCLSA-2026-1793882002 No score
TuxCare security update for org.apache.logging.log4j (2 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.17.0-tuxcare.2.
- Record
CLSA-2026-1793882002- Updated
- 2026-11-06
OSVopenSUSE-SU-2026:10544-1 No score
log4j-2.20.0-2.1 on GA media
These are all security issues fixed in the log4j-2.20.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10544-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1843-1 No score
Security update for log4j
This update for log4j fixes the following issues:
- CVE-2026-34477: TLS connections vulnerable to interception due to incomplete hostname verification configuration checks (bsc#1262050).
- CVE-2026-34479: silent log event loss due to improper XML escaping in
Log4j1XmlLayout(bsc#1262091). - CVE-2026-34480: silent log event loss due to improper XML escaping in
XmlLayout(bsc#1262092). - CVE-2026-34481: silent log event loss due to improper serialization of non-finite floating-point values in
JsonTemplateLayout(bsc#1262093).
- Record
SUSE-SU-2026:1843-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.logging.log4j:log4j-coreMaven |
2.7 up to 2.25.4 | 2.25.4 |
org.apache.logging.log4j:log4j-coreMaven |
3.0.0-beta1 to 3.0.0-beta2 | None known |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 2 CVEs |
2.17.2 up to 2.17.2-tuxcare.1 | 2.17.2-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.17.2 up to 2.17.2-tuxcare.1 | 2.17.2-tuxcare.1 |
log4jTuxCare:AlmaLinux:9.6 |
before 2.17.2-1.el9.tuxcare.els1 | 2.17.2-1.el9.tuxcare.els1 |
log4j-jclTuxCare:AlmaLinux:9.6 |
before 2.17.2-1.el9.tuxcare.els1 | 2.17.2-1.el9.tuxcare.els1 |
log4j-slf4jTuxCare:AlmaLinux:9.6 |
before 2.17.2-1.el9.tuxcare.els1 | 2.17.2-1.el9.tuxcare.els1 |
log4j-webTuxCare:AlmaLinux:9.6 |
before 2.17.2-1.el9.tuxcare.els1 | 2.17.2-1.el9.tuxcare.els1 |
log4jTuxCare:AlmaLinux:9.2 |
before 2.17.2-1.el9_2.tuxcare.els1 | 2.17.2-1.el9_2.tuxcare.els1 |
log4j-jclTuxCare:AlmaLinux:9.2 |
before 2.17.2-1.el9_2.tuxcare.els1 | 2.17.2-1.el9_2.tuxcare.els1 |
Show 71 moreShow less
| Package | Affected | Fixed |
|---|---|---|
log4j-slf4jTuxCare:AlmaLinux:9.2 |
before 2.17.2-1.el9_2.tuxcare.els1 | 2.17.2-1.el9_2.tuxcare.els1 |
log4j-webTuxCare:AlmaLinux:9.2 |
before 2.17.2-1.el9_2.tuxcare.els1 | 2.17.2-1.el9_2.tuxcare.els1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.22.1 up to 2.22.1-tuxcare.1 | 2.22.1-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.22.1 up to 2.22.1-tuxcare.1 | 2.22.1-tuxcare.1 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 3 CVEs |
2.22.1 up to 2.22.1-tuxcare.1 | 2.22.1-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.23.1 up to 2.23.1-tuxcare.1 | 2.23.1-tuxcare.1 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.23.1 up to 2.23.1-tuxcare.1 | 2.23.1-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.23.1 up to 2.23.1-tuxcare.1 | 2.23.1-tuxcare.1 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 3 CVEs |
2.23.1 up to 2.23.1-tuxcare.1 | 2.23.1-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 4 CVEs |
2.24.3 up to 2.24.3-tuxcare.2, plus listed versions 2.24.3-tuxcare.1 |
2.24.3-tuxcare.2 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven From an advisory covering 4 CVEs |
2.24.3 up to 2.24.3-tuxcare.2, plus listed versions 2.24.3-tuxcare.1 |
2.24.3-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 4 CVEs |
2.24.3 up to 2.24.3-tuxcare.2, plus listed versions 2.24.3-tuxcare.1 |
2.24.3-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 2 CVEs |
2.17.1 up to 2.17.1-tuxcare.4, plus listed versions 2.17.1-tuxcare.12.17.1-tuxcare.22.17.1-tuxcare.3 |
2.17.1-tuxcare.4 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.17.1 up to 2.17.1-tuxcare.4, plus listed versions 2.17.1-tuxcare.12.17.1-tuxcare.22.17.1-tuxcare.3 |
2.17.1-tuxcare.4 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.24.1 up to 2.24.1-tuxcare.1 | 2.24.1-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.24.1 up to 2.24.1-tuxcare.1 | 2.24.1-tuxcare.1 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 3 CVEs |
2.24.1 up to 2.24.1-tuxcare.1 | 2.24.1-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.13.3 up to 2.13.3-tuxcare.1 | 2.13.3-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.13.3 up to 2.13.3-tuxcare.1 | 2.13.3-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven |
2.11.1 up to 2.11.1-tuxcare.1 | 2.11.1-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.11.1 up to 2.11.1-tuxcare.1 | 2.11.1-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.19.0 up to 2.19.0-tuxcare.1 | 2.19.0-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.19.0 up to 2.19.0-tuxcare.1 | 2.19.0-tuxcare.1 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 3 CVEs |
2.19.0 up to 2.19.0-tuxcare.1 | 2.19.0-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 5 CVEs |
2.20.0 up to 2.20.0-tuxcare.2, plus listed versions 2.20.0-tuxcare.1 |
2.20.0-tuxcare.2 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven From an advisory covering 5 CVEs |
2.20.0 up to 2.20.0-tuxcare.2, plus listed versions 2.20.0-tuxcare.1 |
2.20.0-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 5 CVEs |
2.20.0 up to 2.20.0-tuxcare.2, plus listed versions 2.20.0-tuxcare.1 |
2.20.0-tuxcare.2 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 5 CVEs |
2.20.0 up to 2.20.0-tuxcare.2, plus listed versions 2.20.0-tuxcare.1 |
2.20.0-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.12.4 up to 2.12.4-tuxcare.2, plus listed versions 2.12.4-tuxcare.1 |
2.12.4-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.12.4 up to 2.12.4-tuxcare.2, plus listed versions 2.12.4-tuxcare.1 |
2.12.4-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 4 CVEs |
2.21.1 up to 2.21.1-tuxcare.1 | 2.21.1-tuxcare.1 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven From an advisory covering 4 CVEs |
2.21.1 up to 2.21.1-tuxcare.1 | 2.21.1-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 4 CVEs |
2.21.1 up to 2.21.1-tuxcare.1 | 2.21.1-tuxcare.1 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 4 CVEs |
2.21.1 up to 2.21.1-tuxcare.1 | 2.21.1-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 5 CVEs |
2.25.2 up to 2.25.2-tuxcare.1 | 2.25.2-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 5 CVEs |
2.25.2 up to 2.25.2-tuxcare.1 | 2.25.2-tuxcare.1 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 5 CVEs |
2.25.2 up to 2.25.2-tuxcare.1 | 2.25.2-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven |
2.8.2 up to 2.8.2-tuxcare.2, plus listed versions 2.8.2-tuxcare.1 |
2.8.2-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.8.2 up to 2.8.2-tuxcare.2, plus listed versions 2.8.2-tuxcare.1 |
2.8.2-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven |
2.9.1 up to 2.9.1-tuxcare.2, plus listed versions 2.9.1-tuxcare.1 |
2.9.1-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.9.1 up to 2.9.1-tuxcare.2, plus listed versions 2.9.1-tuxcare.1 |
2.9.1-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven |
2.7 up to 2.7-tuxcare.2, plus listed versions 2.7-tuxcare.1 |
2.7-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.7 up to 2.7-tuxcare.2, plus listed versions 2.7-tuxcare.1 |
2.7-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 2 CVEs |
2.10.0 up to 2.10.0-tuxcare.2, plus listed versions 2.10.0-tuxcare.1 |
2.10.0-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.10.0 up to 2.10.0-tuxcare.2, plus listed versions 2.10.0-tuxcare.1 |
2.10.0-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.17.0 up to 2.17.0-tuxcare.2, plus listed versions 2.17.0-tuxcare.1 |
2.17.0-tuxcare.2 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 2 CVEs |
2.17.0 up to 2.17.0-tuxcare.2, plus listed versions 2.17.0-tuxcare.1 |
2.17.0-tuxcare.2 |
apache-log4j2Debian:12 |
All versions, plus listed versions 2.19.0-22.26.1-1 |
None known |
apache-log4j2Debian:13 |
All versions, plus listed versions 2.19.0-22.26.1-1 |
None known |
apache-log4j2Debian:14 |
All versions, plus listed versions 2.19.0-22.26.1-1 |
None known |
org.apache.logging.log4j:log4j-coreMaven |
2.7 up to 2.25.4, plus listed versions 2.10.02.11.02.11.12.11.22.12.0 Show 37 moreShow less2.12.12.12.22.12.32.12.42.13.02.13.12.13.22.13.32.14.02.14.12.15.02.16.02.17.02.17.12.17.22.18.02.19.02.20.02.21.02.21.12.22.02.22.12.23.02.23.12.24.02.24.12.24.22.24.32.25.02.25.12.25.22.25.32.82.8.12.8.22.9.02.9.1 |
2.25.4 |
org.apache.logging.log4j:log4j-1.2-apiRoot:Maven |
before 2.19.0-aikido.9 | 2.19.0-aikido.92.23.1-aikido.22.21.1-aikido.52.23.1-aikido.32.25.3-aikido.22.19.0-aikido.9306 |
io.root.org.apache.logging.log4j:log4j-1.2-apiRoot:Maven |
before 2.19.0-root.io.8 | 2.19.0-root.io.82.23.1-root.io.12.21.1-root.io.12.19.0-root.io.92.23.1-root.io.22.21.1-root.io.42.21.1-root.io.52.23.1-root.io.32.25.3-root.io.22.19.0-root.io.9306 |
apache-log4j1.2Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.2.17-3ubuntu11.2.17-4ubuntu11.2.17-4ubuntu21.2.17-4ubuntu31.2.17-4ubuntu3+esm11.2.17-4ubuntu3+esm2 |
None known |
apache-log4j2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.2-12.4-12.4-22.4-2ubuntu0.1~esm1 |
None known |
apache-log4j1.2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.2.17-6ubuntu11.2.17-7ubuntu11.2.17-7ubuntu1+esm11.2.17-7ubuntu1+esm2 |
None known |
apache-log4j1.2Ubuntu:18.04:LTS |
All versions, plus listed versions 1.2.17-7ubuntu21.2.17-81.2.17-8+deb10u1build0.18.04.11.2.17-8+deb10u1ubuntu0.11.2.17-8+deb10u1ubuntu0.2 |
None known |
apache-log4j2Ubuntu:18.04:LTS |
All versions, plus listed versions 2.8.2-12.8.2-22.10.0-12.10.0-22.10.0-2ubuntu0.12.12.4-0ubuntu0.1 |
None known |
apache-log4j1.2Ubuntu:20.04:LTS |
All versions, plus listed versions 1.2.17-81.2.17-91.2.17-9ubuntu0.11.2.17-9ubuntu0.2 |
None known |
apache-log4j2Ubuntu:20.04:LTS |
All versions, plus listed versions 2.11.1-22.11.2-12.15.0-0.20.04.12.16.0-0.20.04.12.17.0-0.20.04.12.17.1-0.20.04.1 |
None known |
apache-log4j1.2Ubuntu:22.04:LTS |
All versions, plus listed versions 1.2.17-101.2.17-11 |
None known |
apache-log4j2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.13.3-12.15.0-12.16.0-12.17.0-12.17.1-1 |
None known |
apache-log4j1.2Ubuntu:24.04:LTS |
All versions, plus listed versions 1.2.17-11 |
None known |
apache-log4j2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.19.0-2 |
None known |
apache-log4j1.2Ubuntu:25.10 |
All versions, plus listed versions 1.2.17-11 |
None known |
apache-log4j2Ubuntu:25.10 |
All versions, plus listed versions 2.19.0-2 |
None known |
apache-log4j1.2Ubuntu:26.10 |
All versions, plus listed versions 1.2.17-11build1 |
None known |
apache-log4j2Ubuntu:26.10 |
All versions, plus listed versions 2.19.0-2build1 |
None known |
apache-log4j1.2Ubuntu:26.04:LTS |
All versions, plus listed versions 1.2.17-111.2.17-11build1 |
None known |
apache-log4j2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.19.0-22.19.0-2build1 |
None known |
log4jopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 2.20.0-2.1 | 2.20.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected | ||
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-34479 is a medium vulnerability (CVSS 6.9) in Apache Log4j, published April 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in org.apache.logging.log4j:log4j-core 2.25.4.
References
github.com/apache/logging-log4j2/pull/4078
logging.apache.org/security.html
lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on
openwall.com/lists/oss-security/2026/04/10/8
Show 19 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-34479
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779124827.html
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2026-34479
suse.com/support/update/announcement/2026/suse-su-20261843-1
bugzilla.suse.com/1262050
ubuntu.com/security/CVE-2026-34479
cve.org/CVERecord?id=CVE-2026-34479