{"id":"CVE-2026-34479","aliases":["CLSA-2026-1776991059","CLSA-2026-1779124827","CLSA-2026-1780054786","CLSA-2026-1780447835","CLSA-2026-1787471222","CLSA-2026-1787726168","CLSA-2026-1788442788","CLSA-2026-1790709023","CLSA-2026-1790872639","CLSA-2026-1790941398","CLSA-2026-1790944047","CLSA-2026-1792696729","CLSA-2026-1792756951","CLSA-2026-1793052872","CLSA-2026-1793354113","CLSA-2026-1793723595","CLSA-2026-1793724321","CLSA-2026-1793724931","CLSA-2026-1793725664","CLSA-2026-1793882002","DEBIAN-CVE-2026-34479","EUVD-2026-21409","GHSA-h383-gmxw-35v2","ROOT-APP-MAVEN-CVE-2026-34479","SUSE-SU-2026:1843-1","UBUNTU-CVE-2026-34479","openSUSE-SU-2026:10544-1"],"status":"published","title":"Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters","description":"The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nTwo groups of users are affected:\n\n  *  Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.\n  *  Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.\n\n\nUsers are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.\n\nNote: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the  Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00544,"percentile":0.46132,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2026-04-10T15:41:07Z","modified":"2026-11-06T13:15:03Z","fixes":[{"ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","fixed_in":["2.25.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"log4j","fixed_in":["2.17.2-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"log4j-jcl","fixed_in":["2.17.2-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"log4j-slf4j","fixed_in":["2.17.2-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"log4j-web","fixed_in":["2.17.2-1.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"log4j","fixed_in":["2.17.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"log4j-jcl","fixed_in":["2.17.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"log4j-slf4j","fixed_in":["2.17.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"log4j-web","fixed_in":["2.17.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","fixed_in":["2.11.1-tuxcare.1","2.8.2-tuxcare.2","2.9.1-tuxcare.2","2.7-tuxcare.2"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","fixed_in":["2.11.1-tuxcare.1","2.8.2-tuxcare.2","2.9.1-tuxcare.2","2.7-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","fixed_in":["2.19.0-aikido.9","2.23.1-aikido.2","2.21.1-aikido.5","2.23.1-aikido.3","2.25.3-aikido.2","2.19.0-aikido.9306"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.logging.log4j:log4j-1.2-api","fixed_in":["2.19.0-root.io.8","2.23.1-root.io.1","2.21.1-root.io.1","2.19.0-root.io.9","2.23.1-root.io.2","2.21.1-root.io.4","2.21.1-root.io.5","2.23.1-root.io.3","2.25.3-root.io.2","2.19.0-root.io.9306"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7"},{"fixed":"2.25.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0-beta1"},{"last_affected":"3.0.0-beta2"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.2"},{"fixed":"2.17.2-tuxcare.1"}]}],"versions":["2.17.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.2"},{"fixed":"2.17.2-tuxcare.1"}]}],"versions":["2.17.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"log4j-jcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"log4j-slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"log4j-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-1.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"log4j-jcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"log4j-slf4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"log4j-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.1"},{"fixed":"2.22.1-tuxcare.1"}]}],"versions":["2.22.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.1"},{"fixed":"2.22.1-tuxcare.1"}]}],"versions":["2.22.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.1"},{"fixed":"2.22.1-tuxcare.1"}]}],"versions":["2.22.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.23.1"},{"fixed":"2.23.1-tuxcare.1"}]}],"versions":["2.23.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.23.1"},{"fixed":"2.23.1-tuxcare.1"}]}],"versions":["2.23.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.23.1"},{"fixed":"2.23.1-tuxcare.1"}]}],"versions":["2.23.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.23.1"},{"fixed":"2.23.1-tuxcare.1"}]}],"versions":["2.23.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.3"},{"fixed":"2.24.3-tuxcare.2"}]}],"versions":["2.24.3","2.24.3-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.3"},{"fixed":"2.24.3-tuxcare.2"}]}],"versions":["2.24.3","2.24.3-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.3"},{"fixed":"2.24.3-tuxcare.2"}]}],"versions":["2.24.3","2.24.3-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.1"},{"fixed":"2.17.1-tuxcare.4"}]}],"versions":["2.17.1","2.17.1-tuxcare.1","2.17.1-tuxcare.2","2.17.1-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.1"},{"fixed":"2.17.1-tuxcare.4"}]}],"versions":["2.17.1","2.17.1-tuxcare.1","2.17.1-tuxcare.2","2.17.1-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.1"},{"fixed":"2.24.1-tuxcare.1"}]}],"versions":["2.24.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.1"},{"fixed":"2.24.1-tuxcare.1"}]}],"versions":["2.24.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.1"},{"fixed":"2.24.1-tuxcare.1"}]}],"versions":["2.24.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.3"},{"fixed":"2.13.3-tuxcare.1"}]}],"versions":["2.13.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.3"},{"fixed":"2.13.3-tuxcare.1"}]}],"versions":["2.13.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.1"},{"fixed":"2.11.1-tuxcare.1"}]}],"versions":["2.11.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.1"},{"fixed":"2.11.1-tuxcare.1"}]}],"versions":["2.11.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.19.0-tuxcare.1"}]}],"versions":["2.19.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.19.0-tuxcare.1"}]}],"versions":["2.19.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.19.0-tuxcare.1"}]}],"versions":["2.19.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.0"},{"fixed":"2.20.0-tuxcare.2"}]}],"versions":["2.20.0","2.20.0-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.0"},{"fixed":"2.20.0-tuxcare.2"}]}],"versions":["2.20.0","2.20.0-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.0"},{"fixed":"2.20.0-tuxcare.2"}]}],"versions":["2.20.0","2.20.0-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.0"},{"fixed":"2.20.0-tuxcare.2"}]}],"versions":["2.20.0","2.20.0-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.4"},{"fixed":"2.12.4-tuxcare.2"}]}],"versions":["2.12.4","2.12.4-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.4"},{"fixed":"2.12.4-tuxcare.2"}]}],"versions":["2.12.4","2.12.4-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.1"},{"fixed":"2.21.1-tuxcare.1"}]}],"versions":["2.21.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.1"},{"fixed":"2.21.1-tuxcare.1"}]}],"versions":["2.21.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.1"},{"fixed":"2.21.1-tuxcare.1"}]}],"versions":["2.21.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.1"},{"fixed":"2.21.1-tuxcare.1"}]}],"versions":["2.21.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.2"},{"fixed":"2.25.2-tuxcare.1"}]}],"versions":["2.25.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.2"},{"fixed":"2.25.2-tuxcare.1"}]}],"versions":["2.25.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.2"},{"fixed":"2.25.2-tuxcare.1"}]}],"versions":["2.25.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.2"},{"fixed":"2.8.2-tuxcare.2"}]}],"versions":["2.8.2","2.8.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.2"},{"fixed":"2.8.2-tuxcare.2"}]}],"versions":["2.8.2","2.8.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1-tuxcare.2"}]}],"versions":["2.9.1","2.9.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1-tuxcare.2"}]}],"versions":["2.9.1","2.9.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7"},{"fixed":"2.7-tuxcare.2"}]}],"versions":["2.7","2.7-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7"},{"fixed":"2.7-tuxcare.2"}]}],"versions":["2.7","2.7-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.0-tuxcare.2"}]}],"versions":["2.10.0","2.10.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.0-tuxcare.2"}]}],"versions":["2.10.0","2.10.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0"},{"fixed":"2.17.0-tuxcare.2"}]}],"versions":["2.17.0","2.17.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0"},{"fixed":"2.17.0-tuxcare.2"}]}],"versions":["2.17.0","2.17.0-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2","2.26.1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2","2.26.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2","2.26.1-1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7"},{"fixed":"2.25.4"}]}],"versions":["2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.17.1","2.17.2","2.18.0","2.19.0","2.20.0","2.21.0","2.21.1","2.22.0","2.22.1","2.23.0","2.23.1","2.24.0","2.24.1","2.24.2","2.24.3","2.25.0","2.25.1","2.25.2","2.25.3","2.7","2.8","2.8.1","2.8.2","2.9.0","2.9.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0-beta1"},{"last_affected":"3.0.0-beta2"}]}],"versions":["3.0.0-beta1","3.0.0-beta2"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.0-aikido.9"},{"fixed":"2.23.1-aikido.2"},{"fixed":"2.21.1-aikido.5"},{"fixed":"2.23.1-aikido.3"},{"fixed":"2.25.3-aikido.2"},{"fixed":"2.19.0-aikido.9306"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.0-root.io.8"},{"fixed":"2.23.1-root.io.1"},{"fixed":"2.21.1-root.io.1"},{"fixed":"2.19.0-root.io.9"},{"fixed":"2.23.1-root.io.2"},{"fixed":"2.21.1-root.io.4"},{"fixed":"2.21.1-root.io.5"},{"fixed":"2.23.1-root.io.3"},{"fixed":"2.25.3-root.io.2"},{"fixed":"2.19.0-root.io.9306"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-3ubuntu1","1.2.17-4ubuntu1","1.2.17-4ubuntu2","1.2.17-4ubuntu3","1.2.17-4ubuntu3+esm1","1.2.17-4ubuntu3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2-1","2.4-1","2.4-2","2.4-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-6ubuntu1","1.2.17-7ubuntu1","1.2.17-7ubuntu1+esm1","1.2.17-7ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-7ubuntu2","1.2.17-8","1.2.17-8+deb10u1build0.18.04.1","1.2.17-8+deb10u1ubuntu0.1","1.2.17-8+deb10u1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-1","2.8.2-2","2.10.0-1","2.10.0-2","2.10.0-2ubuntu0.1","2.12.4-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-8","1.2.17-9","1.2.17-9ubuntu0.1","1.2.17-9ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11.1-2","2.11.2-1","2.15.0-0.20.04.1","2.16.0-0.20.04.1","2.17.0-0.20.04.1","2.17.1-0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-10","1.2.17-11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.13.3-1","2.15.0-1","2.16.0-1","2.17.0-1","2.17.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-11"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-11build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"apache-log4j1.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.17-11","1.2.17-11build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2","2.19.0-2build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-2.1"}]}],"bundled":4}],"products":[{"vendor":"apache","product":"log4j"},{"vendor":"apache software foundation","product":"apache log4j 1 to log4j 2 bridge"}],"references":[{"url":"https://github.com/apache/logging-log4j2/pull/4078","tags":["patch","Exploit","Issue Tracking","Patch","fix","web","report"]},{"url":"https://logging.apache.org/security.html#CVE-2026-34479","tags":["vendor-advisory","Vendor Advisory","advisory","web","report"]},{"url":"https://logging.apache.org/cyclonedx/vdr.xml","tags":["vendor-advisory","Vendor Advisory","advisory","web","report"]},{"url":"https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html","tags":["related","Mitigation","web","report"]},{"url":"https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on","tags":["vendor-advisory","Mailing List","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/10/8","tags":["Mailing List","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34479","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h383-gmxw-35v2"},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1779124827.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1780054786.html","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34479.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34479","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261843-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262050","tags":["report"]},{"url":"https://bugzilla.suse.com/1262091","tags":["report"]},{"url":"https://bugzilla.suse.com/1262092","tags":["report"]},{"url":"https://bugzilla.suse.com/1262093","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34481","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-34479","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34479","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34479","title":"Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters","description":"The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nTwo groups of users are affected:\n\n  *  Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.\n  *  Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.\n\n\nUsers are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.\n\nNote: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the  Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.","status":"published","published":"2026-04-10T15:41:07.888Z","modified":"2026-04-10T17:47:34.402Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-21409","description":"The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nTwo groups of users are affected:\n\n  *  Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.\n  *  Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.\n\n\nUsers are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.\n\nNote: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the  Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.","status":"published","published":"2026-04-10T15:41:07Z","modified":"2026-04-10T17:47:34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:24:29.850635Z"}],"ghsa":[{"id":"GHSA-h383-gmxw-35v2","title":"Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters","description":"The `Log4j1XmlLayout` from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nTwo groups of users are affected:\n\n* Those using `Log4j1XmlLayout` directly in a Log4j Core 2 configuration file.\n* Those using the Log4j 1 configuration compatibility layer with `org.apache.log4j.xml.XMLLayout` specified as the layout class.\n\nUsers are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version `2.25.4`, which corrects this issue.\n\n\u003e [!NOTE]\n\u003e The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the\n\u003e [Log4j 1 to Log4j 2 migration guide](https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html), and specifically the section on eliminating reliance on the bridge.","status":"published","published":"2026-04-10T18:31:18Z","modified":"2026-10-26T15:16:51Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:41:36.858527Z"}],"nvd":[{"id":"CVE-2026-34479","description":"The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nTwo groups of users are affected:\n\n  *  Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.\n  *  Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.\n\n\nUsers are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.\n\nNote: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the  Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.","status":"published","published":"2026-04-10T16:16:31.27Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:12:13.902911Z"}],"osv":[{"id":"CVE-2026-34479","title":"Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters","description":"The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nTwo groups of users are affected:\n\n  *  Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.\n  *  Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.\n\n\nUsers are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.\n\nNote: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the  Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.","status":"published","published":"2026-04-10T15:41:07.888Z","modified":"2026-10-28T02:31:03.785815088Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34479","description":"The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.  Two groups of users are affected:    *  Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.   *  Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.   Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.  Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the  Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.","status":"published","published":"2026-04-10T16:16:31.27Z","modified":"2026-10-27T10:01:05.967036782Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-h383-gmxw-35v2","title":"Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters","description":"The `Log4j1XmlLayout` from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nTwo groups of users are affected:\n\n* Those using `Log4j1XmlLayout` directly in a Log4j Core 2 configuration file.\n* Those using the Log4j 1 configuration compatibility layer with `org.apache.log4j.xml.XMLLayout` specified as the layout class.\n\nUsers are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version `2.25.4`, which corrects this issue.\n\n\u003e [!NOTE]\n\u003e The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the\n\u003e [Log4j 1 to Log4j 2 migration guide](https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html), and specifically the section on eliminating reliance on the bridge.","status":"published","published":"2026-04-10T18:31:18Z","modified":"2026-10-26T15:30:05.71920357Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-34479","title":"CVE-2026-34479 in org.apache.logging.log4j:log4j-1.2-api - Patched by Root","description":"Root has patched CVE-2026-34479 in the org.apache.logging.log4j:log4j-1.2-api package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-27T13:14:33Z","modified":"2026-10-27T14:15:03.443772078Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2026-34479","description":"The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected:   *  Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.   *  Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the  Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.","status":"published","published":"2026-04-10T16:16:00Z","modified":"2026-10-17T13:00:01.720215466Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"CLSA-2026-1776991059","title":"TuxCare security update for org.apache.logging.log4j (2 CVEs)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.17.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-11-02T19:45:26.657533322Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1779124827","title":"log4j: Fix of CVE-2026-34479","description":"- CVE-2026-34479: fix Log4j1XmlLayout invalid XML 1.0 character escape","status":"published","published":"2026-05-18T17:20:36Z","modified":"2026-06-01T00:32:53.686746961Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780054786","title":"log4j: Fix of CVE-2026-34479","description":"- CVE-2026-34479: fix Log4j1XmlLayout invalid XML 1.0 character escape","status":"published","published":"2026-05-29T14:40:54Z","modified":"2026-10-26T09:30:04.922404435Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1780447835","title":"TuxCare security update for org.apache.logging.log4j (3 CVEs)","description":"TuxCare rebuilt 3 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.22.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:35Z","modified":"2026-11-02T19:45:33.874096911Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1787471222","title":"TuxCare security update for org.apache.logging.log4j (3 CVEs)","description":"TuxCare rebuilt 4 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.23.1-tuxcare.1.","status":"published","published":"2026-08-23T07:47:02Z","modified":"2026-11-02T19:46:00.425131919Z","updated_at":"2026-11-02T20:29:46.576514Z"},{"id":"CLSA-2026-1787726168","title":"TuxCare security update for org.apache.logging.log4j (4 CVEs)","description":"TuxCare rebuilt 3 org.apache.logging.log4j packages to address 4 CVEs. Fixed in 2.24.3-tuxcare.2.","status":"published","published":"2026-08-26T06:36:08Z","modified":"2026-11-02T19:45:58.94366801Z","updated_at":"2026-11-02T20:29:49.757752Z"},{"id":"CLSA-2026-1788442788","title":"TuxCare security update for org.apache.logging.log4j (2 CVEs)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.17.1-tuxcare.4.","status":"published","published":"2026-09-03T13:39:48Z","modified":"2026-11-02T19:46:06.117687947Z","updated_at":"2026-11-02T20:29:40.716173Z"},{"id":"CLSA-2026-1790709023","title":"TuxCare security update for org.apache.logging.log4j (3 CVEs)","description":"TuxCare rebuilt 3 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.24.1-tuxcare.1.","status":"published","published":"2026-09-29T19:10:23Z","modified":"2026-11-02T19:46:25.008231607Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1790872639","title":"TuxCare security update for org.apache.logging.log4j (3 CVEs)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.13.3-tuxcare.1.","status":"published","published":"2026-10-01T16:37:19Z","modified":"2026-11-02T19:46:24.964528467Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1790941398","title":"TuxCare security update for org.apache.logging.log4j (1 CVE)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 1 CVE. Fixed in 2.11.1-tuxcare.1.","status":"published","published":"2026-10-02T11:43:18Z","modified":"2026-11-02T19:46:25.891590261Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1790944047","title":"TuxCare security update for org.apache.logging.log4j (3 CVEs)","description":"TuxCare rebuilt 3 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.19.0-tuxcare.1.","status":"published","published":"2026-10-02T12:27:27Z","modified":"2026-11-02T19:46:26.196653528Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1792696729","title":"TuxCare security update for org.apache.logging.log4j (5 CVEs)","description":"TuxCare rebuilt 4 org.apache.logging.log4j packages to address 5 CVEs. Fixed in 2.20.0-tuxcare.2.","status":"published","published":"2026-10-22T19:18:49Z","modified":"2026-11-02T19:46:31.511807766Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792756951","title":"TuxCare security update for org.apache.logging.log4j (3 CVEs)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.12.4-tuxcare.2.","status":"published","published":"2026-10-23T12:02:31Z","modified":"2026-11-02T19:46:31.66329913Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793052872","title":"TuxCare security update for org.apache.logging.log4j (4 CVEs)","description":"TuxCare rebuilt 4 org.apache.logging.log4j packages to address 4 CVEs. Fixed in 2.21.1-tuxcare.1.","status":"published","published":"2026-10-26T22:14:32Z","modified":"2026-11-02T19:46:31.591611961Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793354113","title":"TuxCare security update for org.apache.logging.log4j (5 CVEs)","description":"TuxCare rebuilt 3 org.apache.logging.log4j packages to address 5 CVEs. Fixed in 2.25.2-tuxcare.1.","status":"published","published":"2026-10-30T10:55:14Z","modified":"2026-11-02T19:46:33.204047397Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793723595","title":"TuxCare security update for org.apache.logging.log4j (1 CVE)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 1 CVE. Fixed in 2.8.2-tuxcare.2.","status":"published","published":"2026-11-03T17:33:15Z","modified":"2026-11-03T19:30:07.266827096Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CLSA-2026-1793724321","title":"TuxCare security update for org.apache.logging.log4j (1 CVE)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 1 CVE. Fixed in 2.9.1-tuxcare.2.","status":"published","published":"2026-11-03T17:45:22Z","modified":"2026-11-03T19:30:04.451370591Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CLSA-2026-1793724931","title":"TuxCare security update for org.apache.logging.log4j (1 CVE)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 1 CVE. Fixed in 2.7-tuxcare.2.","status":"published","published":"2026-11-03T17:55:32Z","modified":"2026-11-03T19:30:04.756898179Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CLSA-2026-1793725664","title":"TuxCare security update for org.apache.logging.log4j (2 CVEs)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.10.0-tuxcare.2.","status":"published","published":"2026-11-03T18:07:45Z","modified":"2026-11-03T19:30:09.64142048Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CLSA-2026-1793882002","title":"TuxCare security update for org.apache.logging.log4j (2 CVEs)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.17.0-tuxcare.2.","status":"published","published":"2026-11-05T13:33:23Z","modified":"2026-11-06T13:15:03.968364542Z","updated_at":"2026-11-06T13:44:21.739016Z"},{"id":"openSUSE-SU-2026:10544-1","title":"log4j-2.20.0-2.1 on GA media","description":"These are all security issues fixed in the log4j-2.20.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-14T00:00:00Z","modified":"2026-04-15T08:00:07.138921Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2026:1843-1","title":"Security update for log4j","description":"This update for log4j fixes the following issues:\n\n- CVE-2026-34477: TLS connections vulnerable to interception due to incomplete hostname verification configuration\n  checks (bsc#1262050).\n- CVE-2026-34479: silent log event loss due to improper XML escaping in `Log4j1XmlLayout` (bsc#1262091).\n- CVE-2026-34480: silent log event loss due to improper XML escaping in `XmlLayout` (bsc#1262092).\n- CVE-2026-34481: silent log event loss due to improper serialization of non-finite floating-point values in\n  `JsonTemplateLayout` (bsc#1262093).\n","status":"published","published":"2026-05-13T15:24:57Z","modified":"2026-05-14T08:15:07.933753Z","updated_at":"2026-11-02T15:54:01.610851Z"}]}}