io.root.org.apache.logging.log4j:log4j-core vulnerabilities (Root)

6 vulnerabilities.

• io.root.org.apache.logging.log4j:log4j-core Root Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters CVE-2026-34480 Fix available 6.9 MediumApril 10, 2026
• io.root.org.apache.logging.log4j:log4j-core Root Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility CVE-2026-34478 Fix available 6.9 MediumApril 10, 2026
• io.root.org.apache.logging.log4j:log4j-core Root Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass CVE-2026-34477 Fix available 6.3 MediumApril 10, 2026
• io.root.org.apache.logging.log4j:log4j-core Root Apache Log4j Core: Missing TLS hostname verification in Socket appender CVE-2025-68161 Fix available 6.3 MediumDecember 18, 2025
• io.root.org.apache.logging.log4j:log4j-core Root Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration CVE-2021-44832 Public exploitFix available EPSS 97.9% 6.6 MediumDecember 28, 2021
• io.root.org.apache.logging.log4j:log4j-core Root Apache Log4j2 does not always protect from infinite recursion in lookup evaluation CVE-2021-45105 Public exploitFix available EPSS 100.0% 5.9 MediumDecember 18, 2021