PT-2026-31939 · Apache · Log4J Core

Danish Siddiqui + 6 · Published 2026-04-10 · Updated 2026-05-15 · CVE-2026-34477

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Apache Log4j Core versions 2.12.0 through 2.25.3

Description A flaw exists where hostname verification is ignored when configured through the verifyHostName attribute of the '' element. This occurs even if the attribute is explicitly set, leaving TLS connections susceptible to interception. A network-based attacker could perform a man-in-the-middle attack if an SMTP, Socket, or Syslog appender is used, TLS is configured via a nested '' element, and the attacker possesses a certificate issued by a CA trusted by the configured or default Java trust store.

Recommendations Upgrade to Apache Log4j Core 2.25.4.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-297

Related Identifiers

CVE-2026-34477

GHSA-6HG6-V5C8-FPHQ

OPENSUSE-SU-2026:10544-1

Affected Products

Log4J Core

References · 19

• https://github.com/apache/logging-log4j2/pull/4075 · Patch
• https://logging.apache.org/security.html#CVE-2026-34477 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34477 · Vendor Advisory
• https://logging.apache.org/cyclonedx/vdr.xml · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-34477 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6hg6-v5c8-fphq · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10544-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34477 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-34477 · Security Note
• https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34477 · Vendor Advisory
• https://github.com/apache/logging-log4j2 · Note
• https://twitter.com/VulmonFeeds/status/2042677013878591937 · Twitter Post
• https://suse.com/security/cve/CVE-2026-34480 · Note
• https://suse.com/security/cve/CVE-2026-34481 · Note