7.5

CVE-2026-34479: apache software foundation apache log4j 1 to log4j 2 bridge Improper Encoding or Escaping of Output

CVSS: 7.5v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-34479DEBIAN-CVE-2026-34479CGA-256p-hfmh-m2pg
Published 10-04-2026Last modified 10-04-2026
Open JSON

Vulnerability summary

CVE-2026-34479 is a high (CVSS 7.5) Improper Encoding or Escaping of Output vulnerability in apache software foundation apache log4j 1 to log4j 2 bridge. EPSS estimates a 0.91% chance of exploitation in the next 30 days, higher than 59.2% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
0.91%
0%100%
Low · +0.37 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 1 · Related 2
OPENSUSE-SU-2026:10544-1CGA-XV36-79HH-MJ43

Timeline

  1. 10-04-2026
    PublishedVulnerability first disclosed.
  2. 10-04-2026
    Last modifiedVulnerability information updated.

Description

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.91%

Chance of exploitation in the next 30 days

Percentile

59%

Versus all other CVEs

30-day change

+0.37 pp

From 0.53% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.91%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Logging Log4J2

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard98 products
  • akhq< 0.27.0-r2
  • celeborn-0.5< 0.5.4-r22
  • celeborn-0.6< 0.6.3-r1
  • commercial-elasticsearch-8.17All versions (No fix recorded)
  • commercial-elasticsearch-8.18All versions (No fix recorded)
Wolfi17 products
  • akhq< 0.27.0-r2
  • celeborn-0.6< 0.6.3-r1
  • druid< 36.0.0-r15
  • flink-2.1< 2.1.1-r4
  • flink-2.2< 2.2.0-r5
Ubuntu2 products
  • apache-log4j1.2All versions (No fix recorded)
  • apache-log4j2All versions (No fix recorded)
Apache1 product
  • log4j≥ 2.7, < 2.25.4 | 3.0.0:alpha1 | 3.0.0:alpha1_rc1 | 3.0.0:alpha1_rc2 | 3.0.0:beta1 | 3.0.0:beta2
Apache software foundation1 product
Debian1 product
  • apache-log4j2All versions (No fix recorded)
Org.apache.logging.log4j1 product
  • log4j-1.2-api≥ 2.7, < 2.25.4 | ≥ 3.0.0-beta1, ≤ 3.0.0-beta2

7 vendors · 121 products

References

13 links
Show all 13 references