Improper Output Neutralization for Logs in Apache Log4j - CVE-2026-34478

Vulnerability identifier: #VU128400

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-34478

CWE-ID: CWE-117

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to inject arbitrary log entries.

The vulnerability exists due to improper neutralization of CRLF sequences in Rfc5424Layout when processing logged data with direct Rfc5424Layout configuration using TCP framing. A remote attacker can supply specially crafted input containing CRLF sequences to inject arbitrary log entries.

Only users of stream-based syslog services who configure Rfc5424Layout directly are affected. Users of the SyslogAppender are not affected.

Apache Log4j
Db2 Developer Extension
Storage Protect for Virtual Environments: Data Protection for VMware
Storage Protect for Virtual Environments: Data Protection for Hyper-V
Integration Bus for z/OS
webMethods BPM
ApplinX
watsonx Assistant Cartridge
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
Maximo Scheduler Optimizer
IBM Content Navigator
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Sterling External Authentication Server
IBM Sterling Connect:Direct Web Services
IBM Tivoli Netcool/OMNIbus WebGUI
Netcool/OMNIbus
IBM SPSS Collaboration and Deployment Services
IBM Operator for Apache Flink
IBM Decision Optimization for Cloud Pak for Data
IBM Qradar SIEM
IBM License Metric Tool
JBoss Data Grid
IBM DB2
IBM InfoSphere Information Server
IBM App Connect Enterprise

Install security update from vendor's website.

Apache Log4j - update to 2.25.4
Db2 Developer Extension - update to 1.1.2
IBM Security Guardium Key Lifecycle Manager (GKLM) - addressed in versions 5.0.0 FP3, 5.1.0 FP2
IBM Sterling External Authentication Server - update to 6.1.1.3 iFix01
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.19, 6.4.0.8
IBM Qradar SIEM - update to 7.5.0 Update Pack 16
IBM Tivoli Netcool/OMNIbus WebGUI - update to 8.1.0.41
Netcool/OMNIbus - update to 8.1.0.37
Storage Protect for Virtual Environments: Data Protection for VMware - update to 8.2.2.0
Storage Protect for Virtual Environments: Data Protection for Hyper-V - update to 8.2.2.0
IBM License Metric Tool - update to 9.2.44
webMethods BPM - addressed in versions 10.15 Fix 2, 11.1 Fix 2, 12.1 Fix 1
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 3
IBM App Connect Enterprise - addressed in versions 12.0.12.26, 13.0.7.2
IBM Operator for Apache Flink - update to 1.5.5
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6
watsonx Assistant Cartridge - update to 5.4
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.4
JBoss Data Grid - update to 8.6.1
Maximo Scheduler Optimizer - addressed in versions 9.0.25, 9.1.14, 9.2.1

• https://lists.apache.org/api/email.lua?id=3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt
• https://logging.apache.org/security.html#CVE-2026-34478

• Multiple vulnerabilities in Apache Log4j
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus for z/OS
• Multiple vulnerabilities in IBM Netcool/OMNIbus
• Multiple vulnerabilities in IBM Tivoli Netcool/OMNIbus_GUI
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in IBM ApplinX
• Multiple vulnerabilities in JBoss Data Grid 8.6
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge
• Multiple vulnerabilities in IBM Db2
• Multiple vulnerabilities in IBM License Metric Tool
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM webMethods BPM
• Multiple vulnerabilities in IBM Maximo Scheduler Optimizer
• Multiple vulnerabilities in IBM Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Storage Protect Data Protection for Virtual Environments
• Multiple vulnerabilities in IBM Db2 Developer Extension
• Multiple vulnerabilities in SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM Content Navigator
• Multiple vulnerabilities in IBM Sterling External Authentication Server
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Operator for Apache Flink