CVE-2026-34480
published 2026-04-10CVE-2026-34480: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.86%
54.4th percentile
Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use: * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records. * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | log4j | — | — |
| apache | log4j | >= 2.0 < 2.25.4 | 2.25.4 |
| apache_software_foundation | apache_log4j_core | >= 2.0-alpha1 < 2.25.4 | 2.25.4 |
| apache_software_foundation | apache_log4j_core | 3.0.0-alpha1 – 3.0.0-beta3 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Log4j Core up to 2.25.3/3.0.0-beta3 Conforming Parser escape output (Nessus ID 306043)
vuldb·2026-04-13·CVSS 6.9
CVE-2026-34480 [MEDIUM] Apache Log4j Core up to 2.25.3/3.0.0-beta3 Conforming Parser escape output (Nessus ID 306043)
A vulnerability marked as problematic has been reported in Apache Log4j Core up to 2.25.3/3.0.0-beta3. This vulnerability affects unknown code of the component Conforming Parser. The manipulation leads to escaping of output.
This vulnerability is listed as CVE-2026-34480. The attack may be initiated remotely. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
ghsa·2026-04-10
CVE-2026-34480 [MEDIUM] CWE-116 Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
Apache Log4j Core's [`XmlLayout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout), in versions up to and including 2.25.3, fails to sanitize characters forbidden by the [XML 1.0 specification](https://www.w3.org/TR/xml/#charsets), producing invalid XML output whenever a log message or MDC value contains such characters.
The impact depends on the StAX implementation in use:
* **JRE built-in StAX**: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
* **Alternative StAX implementations** (e.g., [W
Red Hat
org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging
vendor_redhat·2026-04-10·CVSS 6.9
CVE-2026-34480 [MEDIUM] CWE-168 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging
org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging
A flaw was found in Apache Log4j Core. The XmlLayout component, responsible for formatting log messages into XML, does not properly remove or replace characters that are not allowed in XML 1.0. When log messages or diagnostic information contain these forbidden characters, the resulting XML output becomes invalid. This can lead to two main issues: either systems processing these logs will fail to read the affected records, or the logging process itself will stop delivering events, both resulting in a denial of service for logging operations.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security c
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-34480 resteasy: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
bugzilla·2026-04-13·CVSS 6.9
CVE-2026-34480 [MEDIUM] CVE-2026-34480 resteasy: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
CVE-2026-34480 resteasy: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-34480 log4j: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
bugzilla·2026-04-13·CVSS 6.9
CVE-2026-34480 [MEDIUM] CVE-2026-34480 log4j: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
CVE-2026-34480 log4j: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-34480 apache-commons-configuration: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
bugzilla·2026-04-13·CVSS 6.9
CVE-2026-34480 [MEDIUM] CVE-2026-34480 apache-commons-configuration: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
CVE-2026-34480 apache-commons-configuration: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
The log4j functionality is only used for the tests, which are not shipped in any binary RPM. The inputs to log4j are strictly controlled by the tests, preventing the conditions for this CVE from arising.
Bugzilla
CVE-2026-34480 cldr-emoji-annotation: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
bugzilla·2026-04-13·CVSS 6.9
CVE-2026-34480 [MEDIUM] CVE-2026-34480 cldr-emoji-annotation: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
CVE-2026-34480 cldr-emoji-annotation: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-34480 ceph: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
bugzilla·2026-04-13·CVSS 6.9
CVE-2026-34480 [MEDIUM] CVE-2026-34480 ceph: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
CVE-2026-34480 ceph: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-34480 flexmark-java: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
bugzilla·2026-04-13·CVSS 6.9
CVE-2026-34480 [MEDIUM] CVE-2026-34480 flexmark-java: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
CVE-2026-34480 flexmark-java: Apache Log4j Core: Invalid XML output causes denial of service in logging [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
Log4j is only used for the tests and in the flexmark-docx-converter module. We do not build the flexmark-docx-converter module in Fedora because we do not have the docx4j dependency. Inputs to log4j are strictly controlled by the tests and so are not vulnerable.
Bugzilla
CVE-2026-34480 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging
bugzilla·2026-04-10·CVSS 6.9
CVE-2026-34480 [MEDIUM] CVE-2026-34480 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging
CVE-2026-34480 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging
Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
The impact depends on the StAX implementation in use:
* JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
* Alternative StAX implementations
https://github.com/apache/logging-log4j2/pull/4077https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhbhttps://logging.apache.org/cyclonedx/vdr.xmlhttps://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayouthttps://logging.apache.org/security.html#CVE-2026-34480http://www.openwall.com/lists/oss-security/2026/04/10/9
2026-04-10
Published