flink-2.1

7 results · Feed

• Medium 6.3
  CVE-2026-49844 Public exploit

  Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

  Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-…

  Apache Software Foundation Apache Log4j API druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  Jul 10, 2026
• Medium 6.3
  CVE-2026-34481

  Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

  Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinit…

  Apache Software Foundation Apache Log4j JSON Template Layout spark-4.0-scala-2.13 spark-4.1-scala-2.13 Debian Ubuntu Wolfi Maven
  Apr 10, 2026
• Medium 6.9
  CVE-2026-34480

  Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

  Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invali…

  Apache Software Foundation Apache Log4j Core druid airflow-3 Debian Ubuntu Wolfi Maven
  Apr 10, 2026
• Medium 6.9
  CVE-2026-34479

  Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

  The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, …

  Apache Software Foundation Apache Log4j 1 to Log4j 2 bridge druid logstash-9.3-iamguarded-compat Debian Ubuntu Wolfi Maven
  Apr 10, 2026
• Medium 6.9
  CVE-2026-34478

  Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility

  Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attr…

  Apache Software Foundation Apache Log4j Core airflow-3 logstash-9.3-iamguarded-compat Ubuntu Wolfi Maven
  Apr 10, 2026
• Medium 6.3
  CVE-2026-34477

  Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass

  The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.s…

  Apache Software Foundation Apache Log4j Core airflow-3 logstash-9.3-iamguarded-compat Ubuntu Wolfi Maven
  Apr 10, 2026
• Medium 6.3
  CVE-2025-68161

  Apache Log4j Core: Missing TLS hostname verification in Socket appender

  The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-att…

  Apache Software Foundation Apache Log4j Core airflow-3 celeborn-0.6 Debian Ubuntu Wolfi Maven
  Dec 18, 2025