Live › vulnerability › CVE-2026-34479
Go to dashboardThe Log4j1XmlLayout in the Log4j 1-to-2 bridge does not escape characters that XML 1.0 forbids, so the generated XML is malformed. Strict XML parsers reject such records, so downstream log systems may silently drop or fail to index those log events.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 15:18 UTC, 1h before NVD. All times on this page are UTC.
Applications that use the Log4j1XmlLayout directly in a Log4j Core 2 configuration, or that use the Log4j 1 compatibility layer with org.apache.log4j.xml.XMLLayout as the layout class. The impact is loss or failure to index log records downstream, not code execution. Teams that use only the standard Log4j 2 layouts can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.logging.log4j:log4j-core | maven | >= 2.7, < 2.25.4 | 2.25.4 |
| org.apache.logging.log4j:log4j-core | maven | >= 3.0.0-beta1, <= 3.0.0-beta2 | – |
| apache log4j | vendor | >= 2.7, < 2.25.4 | 2.25.4 |
| apache log4j | vendor | = 3.0.0 | – |
mvn dependency:tree | grep log4j-core and check whether the version is at least 2.25.4Log4j1XmlLayout or org.apache.log4j.xml.XMLLayout2.25.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
Two groups of users are affected:
Log4j1XmlLayout directly in a Log4j Core 2 configuration file.org.apache.log4j.xml.XMLLayout specified as the layout class.Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.
[!NOTE] The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide, and specifically the section on eliminating reliance on the bridge.
This page as .md · .json · in your agent: get_signal("CVE-2026-34479")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.