CVE-2026-40023

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40023
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40023.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40023
Downstream
Related
Published
2026-04-10T15:45:52.895Z
Modified
2026-07-15T01:49:14.859592772Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters
Details

Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx11xml11XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.

Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.

Database specific 
{
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-116"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40023.json"
}
References

Affected packages

Git / github.com/apache/logging-log4cxx

Affected ranges

Type
GIT
Repo
https://github.com/apache/logging-log4cxx
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f4930652aa9536d16134450b98c4be177d573615
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:apache:log4cxx:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.7.0"
        }
    ]
}

Affected versions

rel/v0.*
rel/v0.11.0
rel/v0.12.0
rel/v1.*
rel/v1.0.0
rel/v1.1.0
rel/v1.2.0
rel/v1.3.0
rel/v1.3.1
rel/v1.4.0
rel/v1.5.0
rel/v1.6.0
rel/v1.6.1
Other
start@308070
v0_10_0
v0_10_0-rc1@630108
v0_10_0-rc2@630385
v0_10_0-rc3@642292
v0_10_0-rc4@642345
v0_10_0-rc5@642398
v0_10_0-rc6@642451
v0_10_0-rc7@642910
v0_10_0-rc8@1554779
v0_10_0-rc8@643170
v0_10_0@1554779
v0_10_0@643170
v0_10_0@644134
v0_9_4@308324
v0_9_5@308470
v0_9_6@308556
v0_9_7@308613
v0.*
v0.11.0
v0.11.0-RC2
v0.12.0-RC1
v0.12.0-RC2
v1.*
v1.0.0-RC1
v1.1.0-RC1
v1.1.0-RC2
v1.2.0-RC1
v1.3.0-RC1
v1.3.1-RC1
v1.4.0-RC1
v1.5.0-RC1
v1.6.0-RC1
v1.6.1-RC1
v1.6.1-RC2
v1.7.0-RC1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40023.json"