CVE-2026-34477
published 2026-04-10CVE-2026-34477: The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the…
PriorityP434medium5.9CVSS 3.1
AVNACHPRNUINSUCNIHAN
EPSS
0.40%
31.8th percentile
The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the element.
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
* An SMTP, Socket, or Syslog appender is in use.
* TLS is configured via a nested element.
* The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | log4j | — | — |
| apache | log4j | >= 2.12.0 < 2.25.4 | 2.25.4 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa6.3MEDIUM
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification
vendor_redhat·2026-04-10·CVSS 6.3
CVE-2026-34477 [MEDIUM] CWE-295 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification
org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification
A flaw was found in Apache Log4j Core. A network-based attacker can perform a man-in-the-middle (MITM) attack, allowing them to intercept encrypted communications. This occurs when an SMTP, Socket, or Syslog appender uses Transport Layer Security (TLS) with a nested element, and the attacker has a certificate from a trusted Certificate Authority (CA). The vulnerability stems from an incomplete hostname verification fix, making TLS connections susceptible to interception.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability t
VulDB
Apache Log4j Core up to 2.25.3/3.0.0-beta3 log4j2.sslVerifyHostName certificate host validation (Nessus ID 315047 / WID-SEC-2026-1067)
vuldb·2026-05-17·CVSS 6.3
CVE-2026-34477 [MEDIUM] Apache Log4j Core up to 2.25.3/3.0.0-beta3 log4j2.sslVerifyHostName certificate host validation (Nessus ID 315047 / WID-SEC-2026-1067)
A vulnerability identified as critical has been detected in Apache Log4j Core up to 2.25.3/3.0.0-beta3. Affected by this issue is the function log4j2.sslVerifyHostName. Performing a manipulation results in certificate with host mismatch.
This vulnerability is identified as CVE-2026-34477. The attack can be initiated remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
GHSA-6hg6-v5c8-fphq: The fix for CVE-2025-68161 https://logging
ghsa_unreviewed·2026-04-10·CVSS 6.3
CVE-2026-34477 [MEDIUM] CWE-297 GHSA-6hg6-v5c8-fphq: The fix for CVE-2025-68161 https://logging
The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the element.
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
A network-based attacker may be able to perform a man-in-the-middle attack when all of the f
GHSA
Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration
ghsa·2026-04-10·CVSS 6.3
CVE-2026-34477 [MEDIUM] CWE-297 Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration
Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration
The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the [`log4j2.sslVerifyHostName`](https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName) system property, but not when configured through the [`verifyHostName`](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName) attribute of the `` element.
Although the `verifyHostName` configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
A network-based attacker may be able to perform
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-34477 apache-commons-configuration: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
bugzilla·2026-04-13·CVSS 6.3
CVE-2026-34477 [MEDIUM] CVE-2026-34477 apache-commons-configuration: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
CVE-2026-34477 apache-commons-configuration: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
The log4j functionality is only used for the tests, which are not shipped in any binary RPM. The usage in the tests does not meet the conditions described in the CVE.
Bugzilla
CVE-2026-34477 resteasy: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
bugzilla·2026-04-13·CVSS 6.3
CVE-2026-34477 [MEDIUM] CVE-2026-34477 resteasy: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
CVE-2026-34477 resteasy: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-34477 ceph: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
bugzilla·2026-04-13·CVSS 6.3
CVE-2026-34477 [MEDIUM] CVE-2026-34477 ceph: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
CVE-2026-34477 ceph: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-34477 log4j: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
bugzilla·2026-04-13·CVSS 6.3
CVE-2026-34477 [MEDIUM] CVE-2026-34477 log4j: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
CVE-2026-34477 log4j: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-34477 cldr-emoji-annotation: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
bugzilla·2026-04-13·CVSS 6.3
CVE-2026-34477 [MEDIUM] CVE-2026-34477 cldr-emoji-annotation: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
CVE-2026-34477 cldr-emoji-annotation: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-34477 flexmark-java: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
bugzilla·2026-04-13·CVSS 6.3
CVE-2026-34477 [MEDIUM] CVE-2026-34477 flexmark-java: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
CVE-2026-34477 flexmark-java: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
Log4j is only used for the tests and in the flexmark-docx-converter module. We do not build the flexmark-docx-converter module in Fedora because we do not have the docx4j dependency. Inputs to log4j are strictly controlled by the tests and so are not vulnerable.
Bugzilla
CVE-2026-34477 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification
bugzilla·2026-04-10·CVSS 6.3
CVE-2026-34477 [MEDIUM] CVE-2026-34477 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification
CVE-2026-34477 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification
The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the element.
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to inter
https://github.com/apache/logging-log4j2/pull/4075https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4https://logging.apache.org/cyclonedx/vdr.xmlhttps://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostNamehttps://logging.apache.org/security.html#CVE-2026-34477
2026-04-10
Published