Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
Apache Log4j Core's XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification, producing invalid XML output whenever a log message or MDC value contains such characters.
The impact depends on the StAX implementation in use:
- JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
- Alternative StAX implementations (e.g., Woodstox, a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | org.apache.logging.log4j:log4j-core | >= 2.0-alpha1, < 2.25.4, >= 3.0.0-alpha1, <= 3.0.0-beta3 | 2.25.4 |
Referencias
- https://nvd.nist.gov/vuln/detail/CVE-2026-34480
- https://github.com/apache/logging-log4j2/pull/4077
- https://github.com/apache/logging-log4j2
- https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb
- https://logging.apache.org/cyclonedx/vdr.xml
- https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout
- https://logging.apache.org/security.html#CVE-2026-34480
- http://www.openwall.com/lists/oss-security/2026/04/10/9
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N- Debilidad (CWE)
CWE-116- Plataforma
- Java / Kotlin (Maven)
- Paquete
org.apache.logging.log4j:log4j-core- Publicada
- 10.04.2026
- Actualizado
- 11.10.2026 13:20
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-3pxv-7cmr-fjr4 - CC BY 4.0
Historial de vulnerabilidades: org.apache.logging.log4j:log4j-core
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 11
- Primera → última
- 01.2020 04.2026
- Sin corrección
- 0
- Explotada en ataques
- 2
Distribución por gravedad
- Crítica 3
- Alta 2
- Media 5
- Baja 1
Divulgaciones por año
- 2020: 2
- 2021: 3
- 2022: 1
- 2023: 1
- 2024: 0
- 2025: 1
- 2026: 3
-
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.