> CVE-2026-34479 [MEDIUM]

« BACK_TO_HOME
PUBLISHED
2026-04-10 16:16
MODIFIED
2026-04-10 16:16
CVSS_SCORE V3
6.9
EPSS (Prob. Exploit)
0.54%
Top 54.1%
DATA SOURCES:
NVD đź”— 2026-04-10 CWE MITRE đź”— 2026-11-01 FIRST EPSS đź”— 2026-11-08 GITHUB đź”— 2026-10-28 OSV đź”— 2026-11-02 MSRC đź”— 2026-08-01

> DESCRIPTION

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> CVSS V3 METRICS

CVSS_VECTOR
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

> MÉTRIQUES CVSS DÉTAILLÉES

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Métrique Valeur Interprétation
AV (Vecteur d'Attaque)
Attack Vector
Network (N)
Exploit possible à distance via réseau (HTTP, API, etc.)
AC (Complexité d'Attaque)
Attack Complexity
Low (L)
Peu de conditions requises pour exploiter
PR (Privilèges Requis)
Privileges Required
None (N)
Aucune authentification requise
UI (Interaction Utilisateur)
User Interaction
None (N)
Aucune interaction utilisateur nécessaire
S (Périmètre)
Scope
Unchanged (U)
Impact reste dans le périmètre du composant compromis
C (Impact Confidentialité)
Confidentiality Impact
None (N)
Aucune divulgation d'informations
I (Impact Intégrité)
Integrity Impact
None (N)
Aucune modification de données possible
A (Impact Disponibilité)
Availability Impact
None (N)
Aucune interruption de service

> RÉSUMÉ DES IMPACTS

Confidentialité
None
Aucune divulgation d'informations
Intégrité
None
Aucune modification de données possible
Disponibilité
None
Aucune interruption de service

> WEAKNESSES

CWE-116

> CWE DETAILED DESCRIPTIONS

CWE-116: Improper Encoding or Escaping of Output - The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat Offline Knowledge Portal security and content update
Red Hat Offline Knowledge Portal security fixes, bug fixes, enhancements & content update

> GITHUB SECURITY ADVISORY

GHSA-h383-gmxw-35v2 MODERATE

Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

AFFECTED PACKAGES:
MAVEN / org.apache.logging.log4j:log4j-core
>= 3.0.0-beta1, <= 3.0.0-beta2
MAVEN / org.apache.logging.log4j:log4j-core
>= 2.7, < 2.25.4
Fixed in: 2.25.4

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

AFFECTED PACKAGES:
Unknown / Unknown
80 versions affected
ALIASES:
GHSA-h383-gmxw-35v2

> HISTORIQUE DES MODIFICATIONS

Première apparition
10/04/2026 16:16
Source: NVD
đź“Š ENRICHISSEMENT 01/05/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-116: Improper Encoding or Escaping of Output - The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done in...
Total des modifications: 1 Dernière mise à jour: 6 months ago

> REFERENCES

https://github.com/apache/logging-log4j2/pull/4078
https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on
https://logging.apache.org/cyclonedx/vdr.xml
https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html
https://logging.apache.org/security.html#CVE-2026-34479
« BACK_TO_HOME