CVE-2026-34478

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34478
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34478.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34478
Aliases
Downstream
Related
Published
2026-04-10T15:40:17.713Z
Modified
2026-07-15T02:19:25.036632961Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility
Details

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.

Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:

  • The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.
  • The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.

Users of the SyslogAppender are not affected, as its configuration attributes were not modified.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-117",
        "CWE-684"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34478.json",
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/logging-log4j2

Affected ranges

Type
GIT
Repo
https://github.com/apache/logging-log4j2
Events
Introduced
3333493d9a9daabc72d10582c4682538baa93a2a
Fixed
0628e53b25a33e496b509c40a39f2d7c64f2aa6c
Introduced
416cd4dcf419b59c88054d2001d34c7fec010560
Last affected
28117e55f69892d3454672f9399e53fb7b74a321
Database specific 
{
    "cpe": [
        "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "2.21.0"
        },
        {
            "fixed": "2.25.4"
        },
        {
            "introduced": "3.0.0-beta1"
        },
        {
            "last_affected": "3.0.0-beta1"
        },
        {
            "introduced": "3.0.0-beta2"
        },
        {
            "last_affected": "3.0.0-beta2"
        },
        {
            "introduced": "3.0.0-beta3"
        },
        {
            "last_affected": "3.0.0-beta3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

3.*
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34478.json"