PT-2026-31983 · Apache · Apache Log4Cxx

Olawale Titiloye · Published 2026-04-10 · Updated 2026-04-16 · CVE-2026-40023

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Apache Log4cxx versions prior to 1.7.0

Description Apache Log4cxx's XMLLayout fails to sanitize characters forbidden by the XML 1.0 specification in log messages, NDC, and MDC property keys and values, resulting in invalid XML output. This can cause downstream log processing systems to drop or fail to index affected records. An attacker who can influence logged data can exploit this to suppress individual log records, potentially impairing audit trails and detection of malicious activity.

Recommendations Upgrade to Apache Log4cxx version 1.7.0.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-40023

OPENSUSE-SU-2026:10566-1

Affected Products

Apache Log4Cxx

References · 15

• https://github.com/apache/logging-log4cxx/pull/609 · Patch
• https://lists.apache.org/thread/y15cv3zblg3dfwr5vy6ddbnl4zyrzr8b · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-40023 · Vendor Advisory
• https://logging.apache.org/cyclonedx/vdr.xml · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40023 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40023 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40023 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10566-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-40023 · Vendor Advisory
• https://logging.apache.org/security.html#CVE-2026-40023 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40023 · Security Note
• https://twitter.com/CVEnew/status/2042710279356612632 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/10/12 · Note
• https://suse.com/security/cve/CVE-2026-40023 · Note
• https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html · Note