Jabaltarik1

Name of the Vulnerable Software and Affected Versions Apache Log4j Core versions up to and including 2.25.3 Description Apache Log4j Core's XmlLayout fails to sanitize characters forbidden by the XML 1.0 specification, resulting in invalid XML output when log messages or MDC values contain such characters. The impact varies depending on the StAX implementation used. With the JRE built-in StAX, forbidden characters are silently written, leading to malformed XML that may be rejected by parsers. With alternative StAX implementations like Woodstox, an exception is thrown, preventing the log event from being delivered to its intended appender. Recommendations Upgrade to Apache Log4j Core 2.25.4 to correct this issue.

**Name of the Vulnerable Software and Affected Versions** Apache Log4j 1-to-Log4j 2 bridge versions prior to 2.25.4 **Description** The `Log4j1XmlLayout` component fails to escape characters forbidden by the XML 1.0 standard, resulting in malformed XML output. Because conforming XML parsers must reject documents containing these characters with a fatal error, downstream log processing systems may drop or fail to index the affected records. This issue affects users employing `Log4j1XmlLayout` directly in a Log4j Core 2 configuration file or those using the Log4j 1 configuration compatibility layer with `org.apache.log4j.xml.XMLLayout` specified as the layout class. **Recommendations** Upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4.