SB20260428217 - Multiple vulnerabilities in Apache Log4j

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260428217

SB20260428217 - Multiple vulnerabilities in Apache Log4j

Published: April 28, 2026

Security Bulletin ID SB20260428217
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Certificate Validation (CVE-ID: CVE-2026-34477)

The vulnerability allows a remote attacker to perform a man-in-the-middle attack.

The vulnerability exists due to improper certificate validation in the TLS hostname verification handling of the verifyHostName attribute in Log4j Core SSL configuration when establishing TLS connections for SMTP, Socket, or Syslog appenders. A remote attacker can present a certificate issued by a trusted certificate authority to perform a man-in-the-middle attack.

The issue occurs only when TLS is configured via a nested SSL configuration element, and it does not affect the HTTP appender.


2) Improper Output Neutralization for Logs (CVE-ID: CVE-2026-34478)

The vulnerability allows a remote attacker to inject arbitrary log entries.

The vulnerability exists due to improper neutralization of CRLF sequences in Rfc5424Layout when processing logged data with direct Rfc5424Layout configuration using TCP framing. A remote attacker can supply specially crafted input containing CRLF sequences to inject arbitrary log entries.

Only users of stream-based syslog services who configure Rfc5424Layout directly are affected. Users of the SyslogAppender are not affected.


3) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-34479)

The vulnerability allows a remote attacker to cause downstream log processing systems to drop or fail to index affected records.

The vulnerability exists due to improper output neutralization in Log4j1XmlLayout when producing XML log output containing characters forbidden by the XML 1.0 standard. A remote attacker can cause such characters to be included in logged data to cause downstream log processing systems to drop or fail to index affected records.

The issue affects configurations using Log4j1XmlLayout directly in a Log4j Core 2 configuration file or through the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.


4) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-34480)

The vulnerability allows a remote attacker to cause log event loss.

The vulnerability exists due to improper output neutralization in XmlLayout when processing log messages or MDC values containing XML 1.0 forbidden characters. A remote attacker can supply crafted input containing forbidden characters to cause log event loss.

The impact depends on the StAX implementation in use: built-in JRE StAX may produce malformed XML that downstream parsers reject, while alternative implementations may throw an exception during the logging call so the event is delivered only to Log4j's internal status logger.


5) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-34481)

The vulnerability allows a remote attacker to cause downstream log processing systems to reject or fail to index affected records.

The vulnerability exists due to improper serialization of non-finite floating-point values in JsonTemplateLayout when processing log events containing a MapMessage with an attacker-controlled floating-point value. A remote attacker can supply a non-finite floating-point value to cause downstream log processing systems to reject or fail to index affected records.

Exploitation is possible only if the application uses JsonTemplateLayout and logs a MapMessage containing the attacker-controlled value.


Remediation

Install update from vendor's website.

References