CVE-2026-34479

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34479
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34479.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34479
Aliases
Downstream
Related
Published
2026-04-10T15:41:07.888Z
Modified
2026-07-08T08:12:50.259595358Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
Details

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

Two groups of users are affected:

  • Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.
  • Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.

Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.

Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34479.json",
    "cwe_ids": [
        "CWE-116"
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/logging-log4j2

Affected ranges

Type
GIT
Repo
https://github.com/apache/logging-log4j2
Events
Introduced
29cfc80dcddd468c1c5d4ef2c7c4435f90792628
Fixed
0628e53b25a33e496b509c40a39f2d7c64f2aa6c
Introduced
e84827220de69f39112d5f518279038c152b186f
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "2.7"
        },
        {
            "fixed": "2.25.4"
        },
        {
            "introduced": "3.0.0-alpha1"
        },
        {
            "last_affected": "3.0.0-alpha1"
        },
        {
            "introduced": "3.0.0-beta1"
        },
        {
            "last_affected": "3.0.0-beta1"
        },
        {
            "introduced": "3.0.0-beta2"
        },
        {
            "last_affected": "3.0.0-beta2"
        }
    ]
}

Affected versions

3.*
3.0.0-alpha1
3.0.0-beta1
3.0.0-beta2
log4j-2.*
log4j-2.10-rc1
log4j-2.10.0
log4j-2.11.0
log4j-2.11.0-rc1
log4j-2.11.1
log4j-2.11.1-rc1
log4j-2.11.2
log4j-2.11.2-rc1
log4j-2.11.2-rc2
log4j-2.11.2-rc3
log4j-2.12.0
log4j-2.12.0-rc1
log4j-2.12.0-rc2
log4j-2.12.1
log4j-2.12.1-rc1
log4j-2.13.0-rc1
log4j-2.13.0-rc2
log4j-2.13.1
log4j-2.13.1-rc1
log4j-2.13.1-rc2
log4j-2.13.2
log4j-2.13.2-rc1
log4j-2.13.3
log4j-2.13.3-rc1
log4j-2.14.0-rc1
log4j-2.14.1-rc1
log4j-2.15.0-rc1
log4j-2.15.0-rc2
log4j-2.15.1-rc1
log4j-2.16.0-rc1
log4j-2.17.0-rc1
log4j-2.17.1-rc1
log4j-2.17.2-rc1
log4j-2.18.0-rc1
log4j-2.19.0-rc1
log4j-2.19.0-rc2
log4j-2.20.0-rc1
log4j-2.7
log4j-2.7-rc2
log4j-2.8
log4j-2.8-rc1
log4j-2.8.1
log4j-2.8.1-rc1
log4j-2.9-rc1
log4j-2.9.0
log4j-2.9.1-rc1
rel/2.*
rel/2.10.0
rel/2.11.0
rel/2.11.1
rel/2.11.2
rel/2.12.0
rel/2.12.1
rel/2.13.0
rel/2.13.1
rel/2.13.2
rel/2.13.3
rel/2.14.0
rel/2.14.1
rel/2.15.0
rel/2.16.0
rel/2.17.0
rel/2.17.1
rel/2.17.2
rel/2.18.0
rel/2.19.0
rel/2.20.0
rel/2.25.0
rel/2.25.1
rel/2.25.2
rel/2.25.3
rel/2.7
rel/2.8
rel/2.8.1
rel/2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34479.json"