{"id":"CVE-2026-34478","aliases":["CLSA-2026-1787726168","CLSA-2026-1790709023","CLSA-2026-1793354113","EUVD-2026-21408","GHSA-3pxv-7cmr-fjr4","GHSA-445c-vh5m-36rj","GHSA-6hg6-v5c8-fphq","GHSA-vc5p-v9hr-52mj","RHLW-2026-64cfac683d7a9af7","RHLW-2026-97a6348484d7bbf1","ROOT-APP-MAVEN-CVE-2026-34478","UBUNTU-CVE-2026-34478"],"status":"published","title":"Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility","description":"Apache Log4j Core's  Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.\n\nTwo distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:\n\n  *  The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.\n  *  The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.\n\n\nUsers of the SyslogAppender are not affected, as its configuration attributes were not modified.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00989,"percentile":0.6298,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-117","CWE-684"],"published":"2026-04-10T15:40:17Z","modified":"2026-11-06T13:52:52Z","fixes":[{"ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","fixed_in":["2.25.4"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"org.apache.logging.log4j:log4j-core","fixed_in":["2.25.0-aikido.11","2.24.0-aikido.2","2.23.1-aikido.2","2.25.0-aikido.12","2.21.1-aikido.5","2.23.1-aikido.3","2.25.3-aikido.1","2.24.3-aikido.1","2.25.3-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.logging.log4j:log4j-core","fixed_in":["2.25.0-root.io.2","2.25.0-root.io.10","2.23.1-root.io.1","2.21.1-root.io.1","2.24.0-root.io.1","2.25.0-root.io.11","2.24.0-root.io.2","2.23.1-root.io.2","2.21.1-root.io.4","2.25.0-root.io.12","2.21.1-root.io.5","2.23.1-root.io.3","2.25.3-root.io.1","2.24.3-root.io.1","2.25.3-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.0"},{"fixed":"2.25.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0-beta1"},{"last_affected":"3.0.0-beta3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.3"},{"fixed":"2.24.3-tuxcare.2"}]}],"versions":["2.24.3","2.24.3-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.3"},{"fixed":"2.24.3-tuxcare.2"}]}],"versions":["2.24.3","2.24.3-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.3"},{"fixed":"2.24.3-tuxcare.2"}]}],"versions":["2.24.3","2.24.3-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.1"},{"fixed":"2.24.1-tuxcare.1"}]}],"versions":["2.24.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.1"},{"fixed":"2.24.1-tuxcare.1"}]}],"versions":["2.24.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.1"},{"fixed":"2.24.1-tuxcare.1"}]}],"versions":["2.24.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.2"},{"fixed":"2.25.2-tuxcare.1"}]}],"versions":["2.25.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.2"},{"fixed":"2.25.2-tuxcare.1"}]}],"versions":["2.25.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.2"},{"fixed":"2.25.2-tuxcare.1"}]}],"versions":["2.25.2"],"bundled":5},{"source":"osv","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.0"},{"fixed":"2.25.4"}]}],"versions":["2.21.0","2.21.1","2.22.0","2.22.1","2.23.0","2.23.1","2.24.0","2.24.1","2.24.2","2.24.3","2.25.0","2.25.1","2.25.2","2.25.3"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0-beta1"},{"last_affected":"3.0.0-beta3"}]}],"versions":["3.0.0-beta1","3.0.0-beta2","3.0.0-beta3"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.3.rhlw-00004"}]}],"versions":["2.0","2.0-beta5","2.0-beta6","2.0-beta7","2.0-beta8","2.0-beta9","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.1","2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.17.1","2.17.2","2.18.0","2.19.0","2.2","2.20.0","2.21.0","2.21.1","2.22.0","2.22.1","2.23.0","2.23.1","2.24.0","2.24.1","2.24.2","2.24.3","2.3","2.3.1","2.3.2","2.4","2.4.1","2.5","2.6","2.6.1","2.6.2","2.7","2.8","2.8.1","2.8.2","2.9.0","2.9.1"],"bundled":4},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.3.rhlw-00004"}]}],"versions":["2.0","2.0-alpha1","2.0-alpha2","2.0-beta1","2.0-beta2","2.0-beta3","2.0-beta4","2.0-beta5","2.0-beta6","2.0-beta7","2.0-beta8","2.0-beta9","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.1","2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.17.1","2.17.2","2.18.0","2.19.0","2.2","2.20.0","2.21.0","2.21.1","2.22.0","2.22.1","2.23.0","2.23.1","2.24.0","2.24.1","2.24.2","2.24.3","2.3","2.3.1","2.3.2","2.4","2.4.1","2.5","2.6","2.6.1","2.6.2","2.7","2.8","2.8.1","2.8.2","2.9.0","2.9.1"],"bundled":4},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.0-aikido.11"},{"fixed":"2.24.0-aikido.2"},{"fixed":"2.23.1-aikido.2"},{"fixed":"2.25.0-aikido.12"},{"fixed":"2.21.1-aikido.5"},{"fixed":"2.23.1-aikido.3"},{"fixed":"2.25.3-aikido.1"},{"fixed":"2.24.3-aikido.1"},{"fixed":"2.25.3-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.0-root.io.2"},{"fixed":"2.25.0-root.io.10"},{"fixed":"2.23.1-root.io.1"},{"fixed":"2.21.1-root.io.1"},{"fixed":"2.24.0-root.io.1"},{"fixed":"2.25.0-root.io.11"},{"fixed":"2.24.0-root.io.2"},{"fixed":"2.23.1-root.io.2"},{"fixed":"2.21.1-root.io.4"},{"fixed":"2.25.0-root.io.12"},{"fixed":"2.21.1-root.io.5"},{"fixed":"2.23.1-root.io.3"},{"fixed":"2.25.3-root.io.1"},{"fixed":"2.24.3-root.io.1"},{"fixed":"2.25.3-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-3ubuntu1","1.2.17-4ubuntu1","1.2.17-4ubuntu2","1.2.17-4ubuntu3","1.2.17-4ubuntu3+esm1","1.2.17-4ubuntu3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2-1","2.4-1","2.4-2","2.4-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-6ubuntu1","1.2.17-7ubuntu1","1.2.17-7ubuntu1+esm1","1.2.17-7ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-7ubuntu2","1.2.17-8","1.2.17-8+deb10u1build0.18.04.1","1.2.17-8+deb10u1ubuntu0.1","1.2.17-8+deb10u1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-8","1.2.17-9","1.2.17-9ubuntu0.1","1.2.17-9ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-10","1.2.17-11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-11"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-11"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-11build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-11","1.2.17-11build1"]}],"products":[{"vendor":"apache","product":"log4j"},{"vendor":"apache software foundation","product":"apache log4j core"}],"references":[{"url":"https://github.com/apache/logging-log4j2/pull/4074","tags":["patch","Issue Tracking","Patch","fix","web","report"]},{"url":"https://logging.apache.org/security.html#CVE-2026-34478","tags":["vendor-advisory","Vendor Advisory","advisory","web","report"]},{"url":"https://logging.apache.org/cyclonedx/vdr.xml","tags":["vendor-advisory","Product","advisory","web","report"]},{"url":"https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout","tags":["related","Technical Description","web","report"]},{"url":"https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/10/7","tags":["Mailing List","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34478","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-445c-vh5m-36rj","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34478.json","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2","tags":["package"]},{"url":"https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","tags":["web"]},{"url":"https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68161.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","tags":["advisory"]},{"url":"https://logging.apache.org/security.html#CVE-2025-68161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68161","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2/pull/4002","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-vc5p-v9hr-52mj","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34477.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4","tags":["advisory"]},{"url":"https://logging.apache.org/security.html#CVE-2026-34477","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34477","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2/pull/4075","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-6hg6-v5c8-fphq","tags":["advisory"]},{"url":"https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34480.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","tags":["advisory"]},{"url":"https://logging.apache.org/security.html#CVE-2026-34480","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34480","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2/pull/4077","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-3pxv-7cmr-fjr4","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34478","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34478","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-34478","title":"Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility","description":"Apache Log4j Core's  Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.\n\nTwo distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:\n\n  *  The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.\n  *  The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.\n\n\nUsers of the SyslogAppender are not affected, as its configuration attributes were not modified.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.","status":"published","published":"2026-04-10T15:40:17.713Z","modified":"2026-04-10T17:50:12.484Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-684","CWE-117"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-21408","description":"Apache Log4j Core's  Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.\n\nTwo distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:\n\n  *  The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.\n  *  The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.\n\n\nUsers of the SyslogAppender are not affected, as its configuration attributes were not modified.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.","status":"published","published":"2026-04-10T15:40:17Z","modified":"2026-04-10T17:50:12Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:24:29.850635Z"}],"ghsa":[{"id":"GHSA-445c-vh5m-36rj","title":"Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility","description":"Apache Log4j Core's [`Rfc5424Layout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout), in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.\n\nTwo distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:\n\n  *  The `newLineEscape` attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.\n  *  The `useTlsMessageFormat` attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.\n\nUsers of the `SyslogAppender` are not affected, as its configuration attributes were not modified.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.","status":"published","published":"2026-04-10T18:31:17Z","modified":"2026-04-14T00:13:31Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-117","CWE-684"],"updated_at":"2026-11-02T14:39:53.087746Z"}],"nvd":[{"id":"CVE-2026-34478","description":"Apache Log4j Core's  Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.\n\nTwo distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:\n\n  *  The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.\n  *  The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.\n\n\nUsers of the SyslogAppender are not affected, as its configuration attributes were not modified.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.","status":"published","published":"2026-04-10T16:16:31.07Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-117","CWE-684"],"updated_at":"2026-11-02T14:12:13.902911Z"}],"osv":[{"id":"CVE-2026-34478","title":"Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility","description":"Apache Log4j Core's  Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.\n\nTwo distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:\n\n  *  The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.\n  *  The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.\n\n\nUsers of the SyslogAppender are not affected, as its configuration attributes were not modified.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.","status":"published","published":"2026-04-10T15:40:17.713Z","modified":"2026-10-28T02:30:32.707410497Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-117","CWE-684"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"GHSA-445c-vh5m-36rj","title":"Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility","description":"Apache Log4j Core's [`Rfc5424Layout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout), in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.\n\nTwo distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:\n\n  *  The `newLineEscape` attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.\n  *  The `useTlsMessageFormat` attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.\n\nUsers of the `SyslogAppender` are not affected, as its configuration attributes were not modified.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.","status":"published","published":"2026-04-10T18:31:17Z","modified":"2026-09-10T03:50:42.646598813Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-117","CWE-684"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"RHLW-2026-64cfac683d7a9af7","title":"Lightwell Security Advisory: log4j-1.2-api 2.24.3.rhlw-00004","description":"Red Hat Lightwell has released org.apache.logging.log4j:log4j-1.2-api 2.24.3.rhlw-00004 with backported fixes for CVE-2025-68161, CVE-2026-34477, CVE-2026-34478, and CVE-2026-34480.\n\nCVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender\n\nCVE-2026-34477: Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass\n\nCVE-2026-34478: Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility\n\nCVE-2026-34480: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters\n\nThis patched artifact is a drop-in replacement for org.apache.logging.log4j:log4j-1.2-api 2.24.3 from Maven Central.","status":"published","published":"2026-10-08T19:45:56Z","modified":"2026-10-27T04:13:02.72107918Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-97a6348484d7bbf1","title":"Lightwell Security Advisory: log4j-core 2.24.3.rhlw-00004","description":"Red Hat Lightwell has released org.apache.logging.log4j:log4j-core 2.24.3.rhlw-00004 with backported fixes for CVE-2025-68161, CVE-2026-34477, CVE-2026-34478, and CVE-2026-34480.\n\nCVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender\n\nCVE-2026-34477: Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass\n\nCVE-2026-34478: Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility\n\nCVE-2026-34480: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters\n\nThis patched artifact is a drop-in replacement for org.apache.logging.log4j:log4j-core 2.24.3 from Maven Central.","status":"published","published":"2026-10-12T19:52:23Z","modified":"2026-10-27T04:13:03.483520242Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-34478","title":"CVE-2026-34478 in org.apache.logging.log4j:log4j-core - Patched by Root","description":"Root has patched CVE-2026-34478 in the org.apache.logging.log4j:log4j-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-01T09:27:12Z","modified":"2026-10-01T10:15:02.878432152Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2026-34478","description":"Apache Log4j Core's  Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:   *  The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.   *  The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping. Users of the SyslogAppender are not affected, as its configuration attributes were not modified. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.","status":"published","published":"2026-04-10T16:16:00Z","modified":"2026-11-06T13:52:52.032019601Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-06T14:24:15.494232Z"},{"id":"CLSA-2026-1787726168","title":"TuxCare security update for org.apache.logging.log4j (4 CVEs)","description":"TuxCare rebuilt 3 org.apache.logging.log4j packages to address 4 CVEs. Fixed in 2.24.3-tuxcare.2.","status":"published","published":"2026-08-26T06:36:08Z","modified":"2026-11-02T19:45:58.94366801Z","updated_at":"2026-11-02T20:29:49.757752Z"},{"id":"CLSA-2026-1790709023","title":"TuxCare security update for org.apache.logging.log4j (3 CVEs)","description":"TuxCare rebuilt 3 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.24.1-tuxcare.1.","status":"published","published":"2026-09-29T19:10:23Z","modified":"2026-11-02T19:46:25.008231607Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1793354113","title":"TuxCare security update for org.apache.logging.log4j (5 CVEs)","description":"TuxCare rebuilt 3 org.apache.logging.log4j packages to address 5 CVEs. Fixed in 2.25.2-tuxcare.1.","status":"published","published":"2026-10-30T10:55:14Z","modified":"2026-11-02T19:46:33.204047397Z","updated_at":"2026-11-02T20:28:42.34712Z"}]}}