PT-2026-31942 · Apache · Apache Log4J Core

Ap4Sh + 1 · Published 2026-04-10 · Updated 2026-05-15 · CVE-2026-34480

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Log4j Core versions up to and including 2.25.3

Description Apache Log4j Core's XmlLayout fails to sanitize characters forbidden by the XML 1.0 specification, resulting in invalid XML output when log messages or MDC values contain such characters. The impact varies depending on the StAX implementation used. With the JRE built-in StAX, forbidden characters are silently written, leading to malformed XML that may be rejected by parsers. With alternative StAX implementations like Woodstox, an exception is thrown, preventing the log event from being delivered to its intended appender.

Recommendations Upgrade to Apache Log4j Core 2.25.4 to correct this issue.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-34480

GHSA-3PXV-7CMR-FJR4

OPENSUSE-SU-2026:10544-1

Affected Products

Apache Log4J Core

References · 20

• https://github.com/apache/logging-log4j2/pull/4077 · Patch
• https://osv.dev/vulnerability/GHSA-3pxv-7cmr-fjr4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34480 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34480 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-34480 · Vendor Advisory
• https://logging.apache.org/security.html#CVE-2026-34480 · Vendor Advisory
• https://logging.apache.org/cyclonedx/vdr.xml · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10544-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34480 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34480 · Vendor Advisory
• https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34480 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34480 · Security Note
• https://github.com/apache/logging-log4j2 · Note
• https://suse.com/security/cve/CVE-2026-34480 · Note