{"id":"CVE-2026-40023","aliases":["DEBIAN-CVE-2026-40023","EUVD-2026-21490","GHSA-q8qr-wp2r-738r","MGASA-2026-0218","UBUNTU-CVE-2026-40023","openSUSE-SU-2026:10566-1","openSUSE-SU-2026:20705-1"],"status":"published","title":"Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters","description":"Apache Log4cxx's  XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nAn attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.\n\nUsers are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00518,"percentile":0.44386,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116"],"published":"2026-04-10T15:45:52Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"Mageia:9","package":"log4cxx","fixed_in":["1.1.0-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"log4cxx","fixed_in":["1.7.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-1","1.0.0-1+deb12u1","1.1.0-1","1.1.0-1~exp1","1.2.0-1","1.3.0-1","1.3.1-1","1.4.0-1","1.4.0-1.1","1.5.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-1","1.4.0-1+deb13u1","1.4.0-1.1","1.5.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-1","1.4.0-1.1","1.5.0-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1.1.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-1.2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-9ubuntu1","0.10.0-9ubuntu2","0.10.0-10ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-12ubuntu1","0.10.0-13ubuntu1","0.10.0-13ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-15ubuntu1","0.10.0-15ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.0-2ubuntu1","0.11.0-3ubuntu2","0.12.1-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-1","1.1.0-1build1","1.1.0-1build2","1.1.0-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.1-1","1.4.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-1","1.5.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"log4cxx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-2.1"}]}]}],"products":[{"vendor":"apache","product":"log4cxx"},{"vendor":"apache software foundation","product":"apache log4cxx"},{"vendor":"apache software foundation","product":"apache log4cxx (brew)"},{"vendor":"apache software foundation","product":"apache log4cxx (conan)"}],"references":[{"url":"https://github.com/apache/logging-log4cxx/pull/609","tags":["patch","Issue Tracking","Patch","fix","report"]},{"url":"https://logging.apache.org/security.html#CVE-2026-40023","tags":["vendor-advisory","Vendor Advisory","advisory","report"]},{"url":"https://logging.apache.org/cyclonedx/vdr.xml","tags":["vendor-advisory","Product","advisory","report"]},{"url":"https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html","tags":["related","Product","web","report"]},{"url":"https://lists.apache.org/thread/y15cv3zblg3dfwr5vy6ddbnl4zyrzr8b","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/10/12","tags":["Mailing List","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40023","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q8qr-wp2r-738r"},{"url":"https://brew.sh/","tags":["web"]},{"url":"https://conan.io/center","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40023.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-40023","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0218.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35352","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/10/12","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/A7IXK4LCNBBYY5YSNHODMPEG64MYK6VE/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-40023","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40023","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40023","tags":["web"]},{"url":"https://bugzilla.suse.com/1261994","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-40023","title":"Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters","description":"Apache Log4cxx's  XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nAn attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.\n\nUsers are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.","status":"published","published":"2026-04-10T15:45:52.895Z","modified":"2026-04-10T17:29:20.009Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-21490","description":"Apache Log4cxx's  XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nAn attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.\n\nUsers are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.","status":"published","published":"2026-04-10T15:45:52Z","modified":"2026-04-10T17:29:20Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:24:29.850635Z"}],"ghsa":[{"id":"GHSA-q8qr-wp2r-738r","title":"Apache Log4cxx's  XMLLayout https://logging.apache.org/log4cxx/1.7.0...","description":"Apache Log4cxx's  XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nAn attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.\n\nUsers are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.","status":"published","published":"2026-04-10T18:31:18Z","modified":"2026-04-21T15:33:24Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:07:33.597532Z"}],"nvd":[{"id":"CVE-2026-40023","description":"Apache Log4cxx's  XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nAn attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.\n\nUsers are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.","status":"published","published":"2026-04-10T16:16:32.6Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:12:13.902911Z"}],"osv":[{"id":"CVE-2026-40023","title":"Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters","description":"Apache Log4cxx's  XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nAn attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.\n\nUsers are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.","status":"published","published":"2026-04-10T15:45:52.895Z","modified":"2026-10-28T02:30:22.006514827Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T15:45:03.040464Z"},{"id":"DEBIAN-CVE-2026-40023","description":"Apache Log4cxx's  XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.  An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.  Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.","status":"published","published":"2026-04-10T16:16:32.6Z","modified":"2026-10-27T09:47:30.037046565Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"UBUNTU-CVE-2026-40023","description":"Apache Log4cxx's  XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets  in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.","status":"published","published":"2026-04-10T16:16:00Z","modified":"2026-10-17T12:58:13.880353188Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:16.686388Z"},{"id":"MGASA-2026-0218","title":"Updated log4cxx packages fix security vulnerability","description":"CVE-2026-40023, Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx\n(Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0\nforbidden characters\n","status":"published","published":"2026-06-17T06:43:54Z","modified":"2026-06-17T06:45:03.918828755Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10566-1","title":"liblog4cxx-devel-1.7.0-2.1 on GA media","description":"These are all security issues fixed in the liblog4cxx-devel-1.7.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-16T00:00:00Z","modified":"2026-04-17T09:01:01.10038Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20705-1","title":"Security update for log4cxx","description":"This update for log4cxx fixes the following issues:\n\nChanges in log4cxx:\n\n- update to 1.7.0 (bsc#1261994, CVE-2026-40023):\n  * Non-ascii characters incorrectly encoded in JSON output [#615]\n  * XML output could contain characters not allowed by the XML 1.0\n    specification\n  * An XML configuration file with recursive references caused\n    program termination [#605]\n  * Possible undefined behavior during a configuration change\n  * Message loss when the calculation of a logged value also logs\n  * ODBCAppender prepared statement value buffers had incorrect\n    lifetimes [#581]\n\n- update to 1.6.0:\n  * Configuration ${varname} values can be set programatically prior\n    to loading a configuration file (see com/foo/config4.cpp) [#520]\n  * The current executable's file name and its components are available\n    for use in a configuration file and the LOG4CXX_CONFIGURATION\n    environment variable (see log4cxx::spi::Configurator::properties).\n    [#520]\n  * Console output (Log4cxx internal logging and BasicConfigurator)\n    use a color per message level by default [#529]\n  * New logging macros that defer binary-to-text conversion until\n    used in AsyncAppender's background thread\n  * A simplified way to attach an AsyncAppender to a logger using\n    a configuration file [#550]\n","status":"published","published":"2026-05-07T10:19:52Z","modified":"2026-05-09T18:25:07.041035Z","updated_at":"2026-11-02T16:58:41.463445Z"}]}}