{"schema":"threatline.record/2","record":{"id":"CVE-2026-34479","aliases":["GHSA-h383-gmxw-35v2"],"summary":"Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters","details":"The `Log4j1XmlLayout` from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.\n\nTwo groups of users are affected:\n\n* Those using `Log4j1XmlLayout` directly in a Log4j Core 2 configuration file.\n* Those using the Log4j 1 configuration compatibility layer with `org.apache.log4j.xml.XMLLayout` specified as the layout class.\n\nUsers are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version `2.25.4`, which corrects this issue.\n\n> [!NOTE]\n> The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the\n> [Log4j 1 to Log4j 2 migration guide](https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html), and specifically the section on eliminating reliance on the bridge.","categories":["Libraries & packages"],"product":"org.apache.logging.log4j:log4j-core","vendor":"Apache Software Foundation","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h383-gmxw-35v2","source_modified_at":"2026-10-26T15:16:51Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"ecosystem":"maven","name":"org.apache.logging.log4j:log4j-core"},"range":">= 2.7, < 2.25.4"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h383-gmxw-35v2","source_modified_at":"2026-10-26T15:16:51Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"ecosystem":"maven","name":"org.apache.logging.log4j:log4j-core"},"range":">= 3.0.0-beta1, <= 3.0.0-beta2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-34479","source_modified_at":"2026-04-10T17:47:34.402Z","fetched_at":"2026-10-26T19:10:57.178988Z","product":"Apache Log4j 1 to Log4j 2 bridge","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.25.4","status":"affected","version":"2.7","versionType":"maven"},{"lessThanOrEqual":"3.0.0-beta2","status":"affected","version":"3.0.0-alpha1","versionType":"maven"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-h383-gmxw-35v2","source_modified_at":"2026-10-26T15:30:05.719203570Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"org.apache.logging.log4j:log4j-core","ecosystem":"Maven","purl":"pkg:maven/org.apache.logging.log4j/log4j-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7"},{"fixed":"2.25.4"}]}],"versions":["2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.17.1","2.17.2","2.18.0","2.19.0","2.20.0","2.21.0","2.21.1","2.22.0","2.22.1","2.23.0","2.23.1","2.24.0","2.24.1","2.24.2","2.24.3","2.25.0","2.25.1","2.25.2","2.25.3","2.7","2.8","2.8.1","2.8.2","2.9.0","2.9.1"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-h383-gmxw-35v2","source_modified_at":"2026-10-26T15:30:05.719203570Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"org.apache.logging.log4j:log4j-core","ecosystem":"Maven","purl":"pkg:maven/org.apache.logging.log4j/log4j-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0-beta1"},{"last_affected":"3.0.0-beta2"}]}],"versions":["3.0.0-beta1","3.0.0-beta2"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h383-gmxw-35v2","source_modified_at":"2026-10-26T15:16:51Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"ecosystem":"maven","name":"org.apache.logging.log4j:log4j-core"},"version":"2.25.4"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-34479","source_modified_at":"2026-04-10T17:47:34.402Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"Apache Log4j 1 to Log4j 2 bridge","ecosystem":null},"version":"2.25.4","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-h383-gmxw-35v2","source_modified_at":"2026-10-26T15:30:05.719203570Z","fetched_at":"2026-10-26T19:10:57.178988Z","package":{"name":"org.apache.logging.log4j:log4j-core","ecosystem":"Maven","purl":"pkg:maven/org.apache.logging.log4j/log4j-core"},"version":"2.25.4"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00535,"percentile":0.44858,"score_date":"2026-10-26"},"published_at":"2026-04-10T15:41:07.888Z","modified_at":"2026-10-26T15:30:05.719203570Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-h383-gmxw-35v2","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26T15:16:51Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-34479","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-04-10T17:47:34.402Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-h383-gmxw-35v2","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26T15:30:05.719203570Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-34479","fetched_at":"2026-10-26T19:10:57.178988Z","source_modified_at":"2026-10-26"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34479","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/apache/logging-log4j2/pull/4078","tags":["patch"]},{"source":"CVE List","url":"https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://logging.apache.org/cyclonedx/vdr.xml","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html","tags":["related"]},{"source":"CVE List","url":"https://logging.apache.org/security.html#CVE-2026-34479","tags":["vendor-advisory"]},{"url":"https://github.com/advisories/GHSA-h383-gmxw-35v2","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-04-10T17:45:24.466114Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-26T15:30:05.719203570Z","content_hash":"a2f7f9c56bd82a9307e40dbc202159b561708859c0597973bb29fdf4ffc3f666"}}