PT-2026-31941 · Apache · Log4J 1-To-Log4J 2 Bridge

Ap4Sh + 1 · Published 2026-02-16 · Updated 2026-05-27 · CVE-2026-34479

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Log4j 1-to-Log4j 2 bridge versions prior to 2.25.4

Description The Log4j1XmlLayout component fails to escape characters forbidden by the XML 1.0 standard, resulting in malformed XML output. Because conforming XML parsers must reject documents containing these characters with a fatal error, downstream log processing systems may drop or fail to index the affected records. This issue affects users employing Log4j1XmlLayout directly in a Log4j Core 2 configuration file or those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.

Recommendations Upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2026-05273

CLEANSTART-2026-KV09488

CLEANSTART-2026-LO22603

CLEANSTART-2026-PV53006

CVE-2026-34479

GHSA-H383-GMXW-35V2

OPENSUSE-SU-2026:10544-1

Affected Products

Log4J 1-To-Log4J 2 Bridge

References · 94

• https://github.com/apache/logging-log4j2/pull/4078 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41409 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-KV09488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67030 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23868 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-34479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39817 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39826 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42778 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-PV53006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39819 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24308 · Security Note
• https://ubuntu.com/security/CVE-2026-34479 · Vendor Advisory
• https://logging.apache.org/cyclonedx/vdr.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39836 · Security Note