---
id: "CVE-2026-34479"
kind: "vulnerability"
aliases: ["CVE-2026-34479", "GHSA-h383-gmxw-35v2"]
title: "Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters"
severity: "high"
cvss: 7.5
epss: 0.00535
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.logging.log4j:log4j-core", "fixed": ["2.25.4"], "affected": ">= 2.7, < 2.25.4", "ecosystem": "maven"}, {"name": "org.apache.logging.log4j:log4j-core", "fixed": [], "affected": ">= 3.0.0-beta1, <= 3.0.0-beta2", "ecosystem": "maven"}, {"name": "apache log4j", "fixed": ["2.25.4"], "affected": ">= 2.7, < 2.25.4", "ecosystem": "vendor"}, {"name": "apache log4j", "fixed": [], "affected": "= 3.0.0", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["cwe-116", "java", "log4j", "logging", "maven", "package"]
not_affected_if: ["no-log4j1-xml-layout", "standard-log4j2-layouts"]
published_at: "2026-04-10T16:16:31+00:00"
first_seen_at: "2026-10-26T15:18:01+00:00"
updated_at: "2026-10-26T16:02:26+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h383-gmxw-35v2", "first_seen_at": "2026-10-26T15:18:01+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34479", "first_seen_at": "2026-10-26T16:02:26+00:00"}]
---

# Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

The Log4j1XmlLayout in the Log4j 1-to-2 bridge does not escape characters that XML 1.0 forbids, so the generated XML is malformed. Strict XML parsers reject such records, so downstream log systems may silently drop or fail to index those log events.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.logging.log4j:log4j-core affected >= 2.7, < 2.25.4 fixed 2.25.4
- maven:org.apache.logging.log4j:log4j-core affected >= 3.0.0-beta1, <= 3.0.0-beta2 fixed ?
- vendor:apache log4j affected >= 2.7, < 2.25.4 fixed 2.25.4
- vendor:apache log4j affected = 3.0.0 fixed ?

## How to check

- Run `mvn dependency:tree | grep log4j-core` and check whether the version is at least `2.25.4`
- Search Log4j configuration files for `Log4j1XmlLayout` or `org.apache.log4j.xml.XMLLayout`
- Check whether the Log4j 1 compatibility layer is in use for XML output

## Fix

- Upgrade the Log4j 1-to-Log4j 2 bridge to `2.25.4`
- Log4j 3.0.0-beta1 through 3.0.0-beta2 are also listed as affected, with no fixed version given in the sources
- Migrate away from the deprecated bridge and its XML layout, following the Log4j 1 to Log4j 2 migration guide

## Timeline

- 2026-10-26T15:18:01+00:00 ghsa https://github.com/advisories/GHSA-h383-gmxw-35v2
- 2026-10-26T16:02:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-34479

## From the sources

The `Log4j1XmlLayout` from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

Two groups of users are affected:

* Those using `Log4j1XmlLayout` directly in a Log4j Core 2 configuration file.
* Those using the Log4j 1 configuration compatibility layer with `org.apache.log4j.xml.XMLLayout` specified as the layout class.

Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version `2.25.4`, which corrects this issue.

> [!NOTE]
> The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the
> [Log4j 1 to Log4j 2 migration guide](https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html), and specifically the section on eliminating reliance on the bridge.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_