Improper Encoding or Escaping of Output in Apache log4cxx - CVE-2026-40023
Published: April 28, 2026
Vulnerability identifier: #VU128404
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40023
CWE-ID: CWE-116
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to suppress individual log records.
The vulnerability exists due to improper output neutralization in XMLLayout when processing logged data containing XML 1.0 forbidden characters. A remote attacker can inject crafted characters into log messages, NDC, or MDC property keys and values to suppress individual log records.
This can cause downstream log processing systems to reject invalid XML documents and fail to index affected records.
Affected software
Apache log4cxx
Fedora
log4cxx
Fedora
log4cxx
How to mitigate CVE-2026-40023
Install security update from vendor's website.
Apache log4cxx - update to 1.7.0
log4cxx - addressed in versions 1.7.0-2.fc43, 1.7.0-2.fc44, 1.7.0-3.el9, 1.7.0-3.el10_3
log4cxx - addressed in versions 1.7.0-2.fc43, 1.7.0-2.fc44, 1.7.0-3.el9, 1.7.0-3.el10_3