All vulnerabilities
CVE-2026-34479GHSA-h383-gmxw-35v2

org.apache.logging.log4j:log4j-core: Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

Apache Software Foundation org.apache.logging.log4j:log4j-coremavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.53%Chance of exploitation activity in the next 30 days, higher than 44% of CVEs. Scored 26 Oct 2026FIRST EPSS
Fixed in2.25.4Fixed versionGitHub
Published10 Apr 2026Updated 26 Oct 2026CVE List

What fixes it

  • 2.25.4org.apache.logging.log4j:log4j-core, mavenGitHub<dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.25.4</version></dependency>
  • 2.25.4Apache Log4j 1 to Log4j 2 bridgeCVE List
  • 2.25.4org.apache.logging.log4j:log4j-core, MavenOSV<dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.25.4</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

Two groups of users are affected:

  • Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.
  • Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.

Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.

> [!NOTE] > The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the > Log4j 1 to Log4j 2 migration guide, and specifically the section on eliminating reliance on the bridge.

Text from GitHub Advisory Database

Affected versions 51

  • org.apache.logging.log4j:log4j-core, maven>= 2.7, < 2.25.4GitHub
  • org.apache.logging.log4j:log4j-core, maven>= 3.0.0-beta1, <= 3.0.0-beta2GitHub
  • Apache Log4j 1 to Log4j 2 bridgeaffected: 2.7 before 2.25.4CVE List
  • Apache Log4j 1 to Log4j 2 bridgeaffected: 3.0.0-alpha1 through 3.0.0-beta2CVE List
  • org.apache.logging.log4j:log4j-core, Mavenfrom 2.7, fixed in 2.25.4OSV
  • org.apache.logging.log4j:log4j-core, Maven2.10.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.11.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.11.1OSV
  • org.apache.logging.log4j:log4j-core, Maven2.11.2OSV
  • org.apache.logging.log4j:log4j-core, Maven2.12.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.12.1OSV
  • org.apache.logging.log4j:log4j-core, Maven2.12.2OSV
  • org.apache.logging.log4j:log4j-core, Maven2.12.3OSV
  • org.apache.logging.log4j:log4j-core, Maven2.12.4OSV
  • org.apache.logging.log4j:log4j-core, Maven2.13.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.13.1OSV
  • org.apache.logging.log4j:log4j-core, Maven2.13.2OSV
  • org.apache.logging.log4j:log4j-core, Maven2.13.3OSV
  • org.apache.logging.log4j:log4j-core, Maven2.14.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.14.1OSV
  • org.apache.logging.log4j:log4j-core, Maven2.15.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.16.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.17.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.17.1OSV
  • org.apache.logging.log4j:log4j-core, Maven2.17.2OSV
  • org.apache.logging.log4j:log4j-core, Maven2.18.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.19.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.20.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.21.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.21.1OSV
  • org.apache.logging.log4j:log4j-core, Maven2.22.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.22.1OSV
  • org.apache.logging.log4j:log4j-core, Maven2.23.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.23.1OSV
  • org.apache.logging.log4j:log4j-core, Maven2.24.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.24.1OSV
  • org.apache.logging.log4j:log4j-core, Maven2.24.2OSV
  • org.apache.logging.log4j:log4j-core, Maven2.24.3OSV
  • org.apache.logging.log4j:log4j-core, Maven2.25.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.25.1OSV
  • org.apache.logging.log4j:log4j-core, Maven2.25.2OSV
  • org.apache.logging.log4j:log4j-core, Maven2.25.3OSV
  • org.apache.logging.log4j:log4j-core, Maven2.7OSV
  • org.apache.logging.log4j:log4j-core, Maven2.8OSV
  • org.apache.logging.log4j:log4j-core, Maven2.8.1OSV
  • org.apache.logging.log4j:log4j-core, Maven2.8.2OSV
  • org.apache.logging.log4j:log4j-core, Maven2.9.0OSV
  • org.apache.logging.log4j:log4j-core, Maven2.9.1OSV
  • org.apache.logging.log4j:log4j-core, Mavenfrom 3.0.0-beta1, through 3.0.0-beta2OSV
  • org.apache.logging.log4j:log4j-core, Maven3.0.0-beta1OSV
  • org.apache.logging.log4j:log4j-core, Maven3.0.0-beta2OSV

References 7