CVE-2026-40023 Details
Description
Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.
A vulnerability exists in Apache Log4cxx's XMLLayout component, in versions prior to 1.7.0. The issue arises because the layout fails to properly sanitize characters that are forbidden by the XML 1.0 specification. This oversight occurs in log messages, as well as NDC and MDC property keys and values, resulting in the generation of invalid XML. Conforming XML parsers are required to reject such documents, which can cause downstream log processing systems to drop or fail to index the affected records. This vulnerability can be exploited by an attacker who can influence the logged data, leading to the suppression of individual log records and impairing audit trails and the detection of malicious activities.
Users are advised to upgrade to Apache Log4cxx version 1.7.0, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/04/10/12 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/logging-log4cxx/pull/609 | [email protected] | Issue TrackingPatch |
| https://lists.apache.org/thread/y15cv3zblg3dfwr5vy6ddbnl4zyrzr8b | [email protected] | Mailing ListVendor Advisory |
| https://logging.apache.org/cyclonedx/vdr.xml | [email protected] | Product |
| https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html | [email protected] | Product |
| https://logging.apache.org/security.html#CVE-2026-40023 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache log4cxx | < 1.7.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | Initial Analysis | [email protected] |
| Apr 10, 2026 | CVE Modified | CVE |
| Apr 10, 2026 | New CVE Received | [email protected] |