org.apache.logging.log4j:log4j-api vulnerabilities (TuxCare)

7 vulnerabilities.

• org.apache.logging.log4j:log4j-api TuxCare Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson() CVE-2026-49844 Public exploitFix available 6.3 MediumJuly 10, 2026
• org.apache.logging.log4j:log4j-api TuxCare Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout CVE-2026-34481 Fix available 6.3 MediumApril 10, 2026
• org.apache.logging.log4j:log4j-api TuxCare Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters CVE-2026-34480 Fix available 6.9 MediumApril 10, 2026
• org.apache.logging.log4j:log4j-api TuxCare Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters CVE-2026-34479 Fix available 6.9 MediumApril 10, 2026
• org.apache.logging.log4j:log4j-api TuxCare Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility CVE-2026-34478 Fix available 6.9 MediumApril 10, 2026
• org.apache.logging.log4j:log4j-api TuxCare Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass CVE-2026-34477 Fix available 6.3 MediumApril 10, 2026
• org.apache.logging.log4j:log4j-api TuxCare Apache Log4j Core: Missing TLS hostname verification in Socket appender CVE-2025-68161 Fix available 6.3 MediumDecember 18, 2025