Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Log4cxx

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-40023

    Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters

    Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC,…

    Apache Software Foundation Apache Log4cxx Apache Log4cxx (Conan) Apache Log4cxx (Brew) Debian Ubuntu
  • Medium 6.3
    CVE-2025-54813

    Apache Log4cxx: Improper escaping with JSONLayout

    Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message an…

    Apache Software Foundation Apache Log4cxx log4cxx log4cxx Debian Ubuntu