apache-log4j1.2 vulnerabilities (Debian)

6 vulnerabilities.

• apache-log4j1.2 Debian Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters CVE-2026-34480 Fix available 6.9 MediumApril 10, 2026
• apache-log4j1.2 Debian A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution. CVE-2022-23307 Fix available EPSS 54.4% 8.8 HighJanuary 18, 2022
• apache-log4j1.2 Debian SQL injection in JDBC Appender in Apache Log4j V1 CVE-2022-23305 Public exploitFix available EPSS 66.5% 9.8 CriticalJanuary 18, 2022
• apache-log4j1.2 Debian Deserialization of untrusted data in JMSSink in Apache Log4j 1.x CVE-2022-23302 Fix available EPSS 63.8% 8.8 HighJanuary 18, 2022
• apache-log4j1.2 Debian Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVE-2021-4104 Public exploitFix available EPSS 80.6% 7.5 HighDecember 14, 2021
• apache-log4j1.2 Debian Deserialization of Untrusted Data in Log4j CVE-2019-17571 Public exploitFix available EPSS 70.0% 9.8 CriticalDecember 20, 2019