apache-log4j1.2 vulnerabilities (Ubuntu)

10 vulnerabilities.

• apache-log4j1.2 Ubuntu Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout CVE-2026-34481 Fix available 6.3 MediumApril 10, 2026
• apache-log4j1.2 Ubuntu Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters CVE-2026-34480 Fix available 6.9 MediumApril 10, 2026
• apache-log4j1.2 Ubuntu Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters CVE-2026-34479 Fix available 6.9 MediumApril 10, 2026
• apache-log4j1.2 Ubuntu Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility CVE-2026-34478 Fix available 6.9 MediumApril 10, 2026
• apache-log4j1.2 Ubuntu Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender CVE-2023-26464 Fix available 7.5 HighMarch 10, 2023
• apache-log4j1.2 Ubuntu A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution. CVE-2022-23307 Fix available EPSS 54.4% 8.8 HighJanuary 18, 2022
• apache-log4j1.2 Ubuntu SQL injection in JDBC Appender in Apache Log4j V1 CVE-2022-23305 Public exploitFix available EPSS 66.5% 9.8 CriticalJanuary 18, 2022
• apache-log4j1.2 Ubuntu Deserialization of untrusted data in JMSSink in Apache Log4j 1.x CVE-2022-23302 Fix available EPSS 63.8% 8.8 HighJanuary 18, 2022
• apache-log4j1.2 Ubuntu Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVE-2021-4104 Public exploitFix available EPSS 80.6% 7.5 HighDecember 14, 2021
• apache-log4j1.2 Ubuntu Deserialization of Untrusted Data in Log4j CVE-2019-17571 Public exploitFix available EPSS 70.0% 9.8 CriticalDecember 20, 2019