GHSA-445c-vh5m-36rj

Suggest an improvement
Source
https://github.com/advisories/GHSA-445c-vh5m-36rj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-445c-vh5m-36rj/GHSA-445c-vh5m-36rj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-445c-vh5m-36rj
Aliases
  • CVE-2026-34478
Downstream
Related
Published
2026-04-10T18:31:17Z
Modified
2026-04-17T15:29:09.962494399Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility
Details

Apache Log4j Core's Rfc5424Layout, in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.

Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:

  • The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.
  • The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.

Users of the SyslogAppender are not affected, as its configuration attributes were not modified.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

Database specific 
{
    "github_reviewed": true,
    "nvd_published_at": "2026-04-10T16:16:31Z",
    "cwe_ids": [
        "CWE-117",
        "CWE-684"
    ],
    "github_reviewed_at": "2026-04-14T00:13:29Z",
    "severity": "MODERATE"
}
References

Affected packages

Maven / org.apache.logging.log4j:log4j-core

Package

Name
org.apache.logging.log4j:log4j-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.logging.log4j/log4j-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.21.0
Fixed
2.25.4

Affected versions

2.*
2.21.0
2.21.1
2.22.0
2.22.1
2.23.0
2.23.1
2.24.0
2.24.1
2.24.2
2.24.3
2.25.0
2.25.1
2.25.2
2.25.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-445c-vh5m-36rj/GHSA-445c-vh5m-36rj.json"

Maven / org.apache.logging.log4j:log4j-core

Package

Name
org.apache.logging.log4j:log4j-core
View open source insights on deps.dev
Purl
pkg:maven/org.apache.logging.log4j/log4j-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0-beta1
Last affected
3.0.0-beta3

Affected versions

3.*
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-445c-vh5m-36rj/GHSA-445c-vh5m-36rj.json"