GHSA-h383-gmxw-35v2

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

Two groups of users are affected:

Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.
Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.

Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.

[!NOTE] The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide, and specifically the section on eliminating reliance on the bridge.

Database specific

{
    "cwe_ids": [
        "CWE-116"
    ],
    "github_reviewed_at": "2026-04-14T00:10:59Z",
    "nvd_published_at": "2026-04-10T16:16:31Z",
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

Maven / org.apache.logging.log4j:log4j-1.2-api

Package

Name: org.apache.logging.log4j:log4j-1.2-api; View open source insights on deps.dev
Purl: pkg:maven/org.apache.logging.log4j/log4j-1.2-api

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.7

Fixed

2.25.4

Affected versions

2.*

2.7

2.8

2.8.1

2.8.2

2.9.0

2.9.1

2.10.0

2.11.0

2.11.1

2.11.2

2.12.0

2.12.1

2.12.2

2.12.3

2.12.4

2.13.0

2.13.1

2.13.2

2.13.3

2.14.0

2.14.1

2.15.0

2.16.0

2.17.0

2.17.1

2.17.2

2.18.0

2.19.0

2.20.0

2.21.0

2.21.1

2.22.0

2.22.1

2.23.0

2.23.1

2.24.0

2.24.1

2.24.2

2.24.3

2.25.0

2.25.1

2.25.2

2.25.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-h383-gmxw-35v2/GHSA-h383-gmxw-35v2.json"