CVE-2026-34479 Details
Description
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.
A vulnerability exists in the Apache Log4j 1-to-Log4j 2 bridge, specifically in the Log4j1XmlLayout component. This vulnerability arises because the layout fails to properly escape characters that are not allowed by the XML 1.0 standard, leading to the creation of malformed XML. As a result, XML parsers that adhere to the standard are expected to reject such documents, causing downstream log processing systems to either drop or fail to index the affected records. The vulnerability affects two groups of users: those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file, and those utilizing the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout as the specified layout class.
Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which addresses this issue. The bridge is deprecated and will not be available in Log4j 3, so users should consult the Log4j 1 to Log4j 2 migration guide to eliminate reliance on the bridge.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/04/10/8 | CVE | Mailing List |
| https://github.com/apache/logging-log4j2/pull/4078 | [email protected] | ExploitIssue TrackingPatch |
| https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on | [email protected] | Mailing List |
| https://logging.apache.org/cyclonedx/vdr.xml | [email protected] | Vendor Advisory |
| https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html | [email protected] | Mitigation |
| https://logging.apache.org/security.html#CVE-2026-34479 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache log4j | >= 2.7, < 2.25.4 3.0.0 alpha1 3.0.0 alpha1_rc1 3.0.0 alpha1_rc2 3.0.0 beta1 3.0.0 beta2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | Initial Analysis | [email protected] |
| Apr 10, 2026 | CVE Modified | CVE |
| Apr 10, 2026 | New CVE Received | [email protected] |