CVE-2026-34480

Full vulnerability record from the local CVENow database.

Description

Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use: * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records. * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.

Severity

MEDIUM

CVSS score

6.9 (v4.0)

Vulnerability status

Analyzed

Source identifier

[email protected]

Published

2026-04-10 16:16:31.463000

Last modified

2026-10-26 22:10:00.163000

View original CVE JSON

{
  "id": "CVE-2026-34480",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-10T16:16:31.463",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n  *  JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n  *  Alternative StAX implementations (e.g.,  Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output."
    },
    {
      "lang": "es",
      "value": "El XmlLayout de Apache Log4j Core https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , en versiones hasta la 2.25.3 inclusive, no logra sanear los caracteres prohibidos por la especificación XML 1.0 https://www.w3.org/TR/xml/#charsets produciendo una salida XML no válida cada vez que un mensaje de registro o un valor MDC contiene dichos caracteres.\n\nEl impacto depende de la implementación de StAX en uso:\n\n  *  StAX integrado en JRE: Los caracteres prohibidos se escriben silenciosamente en la salida, produciendo XML malformado. Los analizadores conformes deben rechazar dichos documentos con un error fatal, lo que puede hacer que los sistemas de procesamiento de registros posteriores descarten los registros afectados.\n  *  Implementaciones alternativas de StAX (por ejemplo, Woodstox https://github.com/FasterXML/woodstox , una dependencia transitiva del módulo Jackson XML Dataformat): Se lanza una excepción durante la llamada de registro, y el evento de registro nunca se entrega a su appender previsto, solo al registrador de estado interno de Log4j.\n\nSe recomienda a los usuarios actualizar a Apache Log4j Core 2.25.4, que corrige este problema saneando los caracteres prohibidos antes de la salida XML."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Log4j Core",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "packageName": "org.apache.logging.log4j:log4j-core",
          "cpes": [
            "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*"
          ],
          "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-core",
          "versions": [
            {
              "version": "2.0-alpha1",
              "lessThan": "2.25.4",
              "versionType": "maven",
              "status": "affected"
            },
            {
              "version": "3.0.0-alpha1",
              "lessThanOrEqual": "3.0.0-beta3",
              "versionType": "maven",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-10T17:43:51.255638Z",
          "id": "CVE-2026-34480",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.0",
              "versionEndExcluding": "2.25.4",
              "matchCriteriaId": "EB58E4E0-0D2E-4565-9436-5191B31DEB6B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*",
              "matchCriteriaId": "5EE518C3-2F43-40FF-B754-C340B7003FC7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*",
              "matchCriteriaId": "6D2A01C1-D56C-4198-8ADB-11739F791E2B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*",
              "matchCriteriaId": "D6F8BD61-DD30-4D64-842C-850E5B117036"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "ED00C38D-27EA-489C-9A2B-3594ACA8A3C5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "8794D719-1D90-4378-B48B-698EA40FBFB2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "74C9FCBD-ECAD-4C29-B97A-2B9D97C0FC1F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/apache/logging-log4j2/pull/4077",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb",
      "source": "[email protected]",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://logging.apache.org/cyclonedx/vdr.xml",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout",
      "source": "[email protected]",
      "tags": [
        "Technical Description"
      ]
    },
    {
      "url": "https://logging.apache.org/security.html#CVE-2026-34480",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/04/10/9",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}