CVE-2026-34480
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
The impact depends on the StAX implementation in use:
- JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
- Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
The impact depends on the StAX implementation in use:
- JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
- Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
- Record
CVE-2026-34480- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
EUVDEUVD-2026-21410
Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
The impact depends on the StAX implementation in use:
- JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
- Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
- Record
EUVD-2026-21410- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3pxv-7cmr-fjr4
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
Apache Log4j Core's XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification, producing invalid XML output whenever a log message or MDC value contains such characters.
The impact depends on the StAX implementation in use:
- JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
- Alternative StAX implementations (e.g., Woodstox, a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
- Record
GHSA-3pxv-7cmr-fjr4- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
NVD
Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
The impact depends on the StAX implementation in use:
- JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
- Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
- Record
CVE-2026-34480- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSV
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
The impact depends on the StAX implementation in use:
- JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
- Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
- Record
CVE-2026-34480- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-34480
Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use: * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records. * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
- Record
DEBIAN-CVE-2026-34480- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 24 moreShow less
OSVGHSA-3pxv-7cmr-fjr4
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
Apache Log4j Core's XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification, producing invalid XML output whenever a log message or MDC value contains such characters.
The impact depends on the StAX implementation in use:
- JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
- Alternative StAX implementations (e.g., Woodstox, a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
- Record
GHSA-3pxv-7cmr-fjr4- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSVRHLW-2026-64cfac683d7a9af7
Lightwell Security Advisory: log4j-1.2-api 2.24.3.rhlw-00004
Red Hat Lightwell has released org.apache.logging.log4j:log4j-1.2-api 2.24.3.rhlw-00004 with backported fixes for CVE-2025-68161, CVE-2026-34477, CVE-2026-34478, and CVE-2026-34480.
CVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender
CVE-2026-34477: Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass
CVE-2026-34478: Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility
CVE-2026-34480: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
This patched artifact is a drop-in replacement for org.apache.logging.log4j:log4j-1.2-api 2.24.3 from Maven Central.
- Record
RHLW-2026-64cfac683d7a9af7- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
OSVRHLW-2026-97a6348484d7bbf1
Lightwell Security Advisory: log4j-core 2.24.3.rhlw-00004
Red Hat Lightwell has released org.apache.logging.log4j:log4j-core 2.24.3.rhlw-00004 with backported fixes for CVE-2025-68161, CVE-2026-34477, CVE-2026-34478, and CVE-2026-34480.
CVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender
CVE-2026-34477: Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass
CVE-2026-34478: Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility
CVE-2026-34480: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
This patched artifact is a drop-in replacement for org.apache.logging.log4j:log4j-core 2.24.3 from Maven Central.
- Record
RHLW-2026-97a6348484d7bbf1- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-34480
CVE-2026-34480 in org.apache.logging.log4j:log4j-core - Patched by Root
Root has patched CVE-2026-34480 in the org.apache.logging.log4j:log4j-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-34480- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-34480
Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use: * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records. * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
- Record
UBUNTU-CVE-2026-34480- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1776991059 No score
TuxCare security update for org.apache.logging.log4j (2 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.17.2-tuxcare.1.
- Record
CLSA-2026-1776991059- Updated
- 2026-11-02
OSVCLSA-2026-1780447835 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 3 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.22.1-tuxcare.1.
- Record
CLSA-2026-1780447835- Updated
- 2026-11-02
OSVCLSA-2026-1788442788 No score
TuxCare security update for org.apache.logging.log4j (2 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.17.1-tuxcare.4.
- Record
CLSA-2026-1788442788- Updated
- 2026-11-02
OSVCLSA-2026-1790619390 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (3 CVEs)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 3 CVEs. Fixed in 2.11.0-tuxcare.2.
- Record
CLSA-2026-1790619390- Updated
- 2026-11-02
OSVCLSA-2026-1790671828 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (3 CVEs)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 3 CVEs. Fixed in 2.5-tuxcare.2.
- Record
CLSA-2026-1790671828- Updated
- 2026-11-02
OSVCLSA-2026-1790872128 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.7-tuxcare.1.
- Record
CLSA-2026-1790872128- Updated
- 2026-11-02
OSVCLSA-2026-1790872639 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.13.3-tuxcare.1.
- Record
CLSA-2026-1790872639- Updated
- 2026-11-02
OSVCLSA-2026-1791190936 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.6.2-tuxcare.1.
- Record
CLSA-2026-1791190936- Updated
- 2026-11-02
OSVCLSA-2026-1791375236 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (3 CVEs)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 3 CVEs. Fixed in 2.23.1-tuxcare.2.
- Record
CLSA-2026-1791375236- Updated
- 2026-11-02
OSVCLSA-2026-1792102359 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.9.1-tuxcare.1.
- Record
CLSA-2026-1792102359- Updated
- 2026-11-02
OSVCLSA-2026-1792577744 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.11.1-tuxcare.2.
- Record
CLSA-2026-1792577744- Updated
- 2026-11-02
OSVCLSA-2026-1792694422 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.8.2-tuxcare.1.
- Record
CLSA-2026-1792694422- Updated
- 2026-11-02
OSVCLSA-2026-1792694968 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.10.0-tuxcare.1.
- Record
CLSA-2026-1792694968- Updated
- 2026-11-02
OSVCLSA-2026-1792756951 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.12.4-tuxcare.2.
- Record
CLSA-2026-1792756951- Updated
- 2026-11-02
OSVCLSA-2026-1793191907 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.24.3-tuxcare.5.
- Record
CLSA-2026-1793191907- Updated
- 2026-11-02
OSVCLSA-2026-1793727635 No score
TuxCare security update for org.apache.logging.log4j (2 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.24.1-tuxcare.4.
- Record
CLSA-2026-1793727635- Updated
- 2026-11-04
OSVCLSA-2026-1793731769 No score
TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)
TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.25.2-tuxcare.2.
- Record
CLSA-2026-1793731769- Updated
- 2026-11-04
OSVopenSUSE-SU-2026:10544-1 No score
log4j-2.20.0-2.1 on GA media
These are all security issues fixed in the log4j-2.20.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10544-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:1843-1 No score
Security update for log4j
This update for log4j fixes the following issues:
- CVE-2026-34477: TLS connections vulnerable to interception due to incomplete hostname verification configuration checks (bsc#1262050).
- CVE-2026-34479: silent log event loss due to improper XML escaping in
Log4j1XmlLayout(bsc#1262091). - CVE-2026-34480: silent log event loss due to improper XML escaping in
XmlLayout(bsc#1262092). - CVE-2026-34481: silent log event loss due to improper serialization of non-finite floating-point values in
JsonTemplateLayout(bsc#1262093).
- Record
SUSE-SU-2026:1843-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.logging.log4j:log4j-coreMaven |
2.0-alpha1 up to 2.25.4 | 2.25.4 |
org.apache.logging.log4j:log4j-coreMaven |
3.0.0-alpha1 to 3.0.0-beta3 | None known |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 2 CVEs |
2.17.2 up to 2.17.2-tuxcare.1 | 2.17.2-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.17.2 up to 2.17.2-tuxcare.1 | 2.17.2-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.22.1 up to 2.22.1-tuxcare.1 | 2.22.1-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.22.1 up to 2.22.1-tuxcare.1 | 2.22.1-tuxcare.1 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 3 CVEs |
2.22.1 up to 2.22.1-tuxcare.1 | 2.22.1-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 2 CVEs |
2.17.1 up to 2.17.1-tuxcare.4, plus listed versions 2.17.1-tuxcare.12.17.1-tuxcare.22.17.1-tuxcare.3 |
2.17.1-tuxcare.4 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.17.1 up to 2.17.1-tuxcare.4, plus listed versions 2.17.1-tuxcare.12.17.1-tuxcare.22.17.1-tuxcare.3 |
2.17.1-tuxcare.4 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.11.0 up to 2.11.0-tuxcare.2, plus listed versions 2.11.0-tuxcare.1 |
2.11.0-tuxcare.2 |
Show 46 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.5 up to 2.5-tuxcare.2, plus listed versions 2.5-tuxcare.1 |
2.5-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.7 up to 2.7-tuxcare.1 | 2.7-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.13.3 up to 2.13.3-tuxcare.1 | 2.13.3-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.13.3 up to 2.13.3-tuxcare.1 | 2.13.3-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.6.2 up to 2.6.2-tuxcare.1 | 2.6.2-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.23.1 up to 2.23.1-tuxcare.2, plus listed versions 2.23.1-tuxcare.1 |
2.23.1-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.9.1 up to 2.9.1-tuxcare.1 | 2.9.1-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.11.1 up to 2.11.1-tuxcare.2, plus listed versions 2.11.1-tuxcare.1 |
2.11.1-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.8.2 up to 2.8.2-tuxcare.1 | 2.8.2-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.10.0 up to 2.10.0-tuxcare.1 | 2.10.0-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.12.4 up to 2.12.4-tuxcare.2, plus listed versions 2.12.4-tuxcare.1 |
2.12.4-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.12.4 up to 2.12.4-tuxcare.2, plus listed versions 2.12.4-tuxcare.1 |
2.12.4-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.24.3 up to 2.24.3-tuxcare.5, plus listed versions 2.24.3-tuxcare.12.24.3-tuxcare.22.24.3-tuxcare.32.24.3-tuxcare.4 |
2.24.3-tuxcare.5 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven From an advisory covering 2 CVEs |
2.24.1 up to 2.24.1-tuxcare.4, plus listed versions 2.24.1-tuxcare.12.24.1-tuxcare.22.24.1-tuxcare.3 |
2.24.1-tuxcare.4 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.24.1 up to 2.24.1-tuxcare.4, plus listed versions 2.24.1-tuxcare.12.24.1-tuxcare.22.24.1-tuxcare.3 |
2.24.1-tuxcare.4 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven |
2.25.2 up to 2.25.2-tuxcare.2, plus listed versions 2.25.2-tuxcare.1 |
2.25.2-tuxcare.2 |
apache-log4j1.2Debian:12 |
All versions, plus listed versions 1.2.17-11 |
None known |
apache-log4j1.2Debian:13 |
All versions, plus listed versions 1.2.17-11 |
None known |
apache-log4j1.2Debian:14 |
All versions, plus listed versions 1.2.17-11 |
None known |
apache-log4j2Debian:12 |
All versions, plus listed versions 2.19.0-22.26.1-1 |
None known |
apache-log4j2Debian:13 |
All versions, plus listed versions 2.19.0-22.26.1-1 |
None known |
apache-log4j2Debian:14 |
All versions, plus listed versions 2.19.0-22.26.1-1 |
None known |
org.apache.logging.log4j:log4j-coreMaven |
2.0-alpha1 up to 2.25.4, plus listed versions 2.02.0-alpha22.0-beta12.0-beta22.0-beta3 Show 45 moreShow less2.0-beta42.0-beta52.0-beta62.0-beta72.0-beta82.0-beta92.0-rc12.0-rc22.0.12.0.22.12.10.02.11.02.11.12.11.22.12.02.12.12.12.22.12.32.12.42.13.02.13.12.13.22.13.32.14.02.14.12.15.02.16.02.17.02.17.12.17.22.18.02.19.02.22.20.02.21.02.21.12.22.02.22.12.23.02.23.12.24.02.24.12.24.22.24.3 |
2.25.4 |
org.apache.logging.log4j:log4j-coreMaven |
3.0.0-alpha1 to 3.0.0-beta3, plus listed versions 3.0.0-beta13.0.0-beta2 |
None known |
org.apache.logging.log4j:log4j-1.2-apiRed Hat Lightwell:Maven From an advisory covering 4 CVEs |
before 2.24.3.rhlw-00004, plus listed versions 2.02.0-beta52.0-beta62.0-beta72.0-beta8 Show 45 moreShow less2.0-beta92.0-rc12.0-rc22.0.12.0.22.12.10.02.11.02.11.12.11.22.12.02.12.12.12.22.12.32.12.42.13.02.13.12.13.22.13.32.14.02.14.12.15.02.16.02.17.02.17.12.17.22.18.02.19.02.22.20.02.21.02.21.12.22.02.22.12.23.02.23.12.24.02.24.12.24.22.24.32.32.3.12.3.22.42.4.1 |
2.24.3.rhlw-00004 |
org.apache.logging.log4j:log4j-coreRed Hat Lightwell:Maven From an advisory covering 4 CVEs |
before 2.24.3.rhlw-00004, plus listed versions 2.02.0-alpha12.0-alpha22.0-beta12.0-beta2 Show 45 moreShow less2.0-beta32.0-beta42.0-beta52.0-beta62.0-beta72.0-beta82.0-beta92.0-rc12.0-rc22.0.12.0.22.12.10.02.11.02.11.12.11.22.12.02.12.12.12.22.12.32.12.42.13.02.13.12.13.22.13.32.14.02.14.12.15.02.16.02.17.02.17.12.17.22.18.02.19.02.22.20.02.21.02.21.12.22.02.22.12.23.02.23.12.24.02.24.12.24.2 |
2.24.3.rhlw-00004 |
org.apache.logging.log4j:log4j-coreRoot:Maven |
before 2.12.4-aikido.10 | 2.12.4-aikido.102.19.0-aikido.92.25.0-aikido.112.24.0-aikido.22.23.1-aikido.22.25.0-aikido.122.21.1-aikido.52.23.1-aikido.32.25.3-aikido.12.24.3-aikido.12.25.3-aikido.22.19.0-aikido.9306 |
io.root.org.apache.logging.log4j:log4j-coreRoot:Maven |
before 2.19.0-root.io.3 | 2.19.0-root.io.32.12.4-root.io.22.25.0-root.io.22.12.4-root.io.32.19.0-root.io.82.12.4-root.io.92.25.0-root.io.102.23.1-root.io.12.21.1-root.io.12.17.0-root.io.82.24.0-root.io.12.12.4-root.io.102.19.0-root.io.92.25.0-root.io.112.24.0-root.io.22.23.1-root.io.22.21.1-root.io.42.25.0-root.io.122.17.0-root.io.112.17.0-root.io.122.21.1-root.io.52.23.1-root.io.32.25.3-root.io.12.24.3-root.io.12.25.3-root.io.22.19.0-root.io.9306 |
apache-log4j1.2Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.2.17-3ubuntu11.2.17-4ubuntu11.2.17-4ubuntu21.2.17-4ubuntu31.2.17-4ubuntu3+esm11.2.17-4ubuntu3+esm2 |
None known |
apache-log4j2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.2-12.4-12.4-22.4-2ubuntu0.1~esm1 |
None known |
apache-log4j1.2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.2.17-6ubuntu11.2.17-7ubuntu11.2.17-7ubuntu1+esm11.2.17-7ubuntu1+esm2 |
None known |
apache-log4j1.2Ubuntu:18.04:LTS |
All versions, plus listed versions 1.2.17-7ubuntu21.2.17-81.2.17-8+deb10u1build0.18.04.11.2.17-8+deb10u1ubuntu0.11.2.17-8+deb10u1ubuntu0.2 |
None known |
apache-log4j2Ubuntu:18.04:LTS |
All versions, plus listed versions 2.8.2-12.8.2-22.10.0-12.10.0-22.10.0-2ubuntu0.12.12.4-0ubuntu0.1 |
None known |
apache-log4j1.2Ubuntu:20.04:LTS |
All versions, plus listed versions 1.2.17-81.2.17-91.2.17-9ubuntu0.11.2.17-9ubuntu0.2 |
None known |
apache-log4j2Ubuntu:20.04:LTS |
All versions, plus listed versions 2.11.1-22.11.2-12.15.0-0.20.04.12.16.0-0.20.04.12.17.0-0.20.04.12.17.1-0.20.04.1 |
None known |
apache-log4j1.2Ubuntu:22.04:LTS |
All versions, plus listed versions 1.2.17-101.2.17-11 |
None known |
apache-log4j2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.13.3-12.15.0-12.16.0-12.17.0-12.17.1-1 |
None known |
apache-log4j1.2Ubuntu:24.04:LTS |
All versions, plus listed versions 1.2.17-11 |
None known |
apache-log4j2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.19.0-2 |
None known |
apache-log4j1.2Ubuntu:25.10 |
All versions, plus listed versions 1.2.17-11 |
None known |
apache-log4j2Ubuntu:25.10 |
All versions, plus listed versions 2.19.0-2 |
None known |
apache-log4j1.2Ubuntu:26.10 |
All versions, plus listed versions 1.2.17-11build1 |
None known |
apache-log4j2Ubuntu:26.10 |
All versions, plus listed versions 2.19.0-2build1 |
None known |
apache-log4j1.2Ubuntu:26.04:LTS |
All versions, plus listed versions 1.2.17-111.2.17-11build1 |
None known |
apache-log4j2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.19.0-22.19.0-2build1 |
None known |
log4jopenSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 2.20.0-2.1 | 2.20.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-34480 is a medium vulnerability (CVSS 6.9) in Apache Log4j, published April 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in org.apache.logging.log4j:log4j-core 2.25.4.
References
github.com/apache/logging-log4j2/pull/4077
logging.apache.org/security.html
lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb
openwall.com/lists/oss-security/2026/04/10/9
Show 34 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-34480
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2026-34480
suse.com/support/update/announcement/2026/suse-su-20261843-1
bugzilla.suse.com/1262050
ubuntu.com/security/CVE-2026-34480
cve.org/CVERecord?id=CVE-2026-34480
Left out here: 45 versions. The JSON record has them.