Description
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
Two groups of users are affected:
* Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.
* Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.
Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.
Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Log4j 1 to Log4j 2 bridge | 2.7 – < 2.25.4, 3.0.0-alpha1 – ≤ 3.0.0-beta2 | 2.25.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache-log4j2 | No fix yet | — |
| Debian 13 | apache-log4j2 | No fix yet | — |
| Debian 12 | apache-log4j2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | apache-log4j2 +1 | No fix yet | — |
| Ubuntu 26.04 LTS | apache-log4j2 +1 | No fix yet | — |
| Ubuntu 25.10 | apache-log4j2 +1 | No fix yet | — |
| Ubuntu 24.04 LTS | apache-log4j2 +1 | No fix yet | — |
| Ubuntu 22.04 LTS | apache-log4j2 +1 | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | apache-log4j2 +1 | No fix yet | — |
| Ubuntu 18.04 LTS | apache-log4j2 +1 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | apache-log4j2 +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | apache-log4j1.2 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | log4j | 2.20.0-2.1 | openSUSE-SU-2026:10544-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | akhq | 0.27.0-r2 | — |
| Wolfi rolling | celeborn-0.6 | 0.6.3-r1 | — |
| Wolfi rolling | druid | 36.0.0-r15 | — |
| Wolfi rolling | flink-2.1 | 2.1.1-r4 | — |
| Wolfi rolling | flink-2.2 | 2.2.0-r5 | — |
| Wolfi rolling | kafka-4.1 | 4.1.2-r2 | — |
| Wolfi rolling | kafka-4.2 | 4.2.0-r5 | — |
| Wolfi rolling | kserve-modelmesh | 0.12.0-r31 | — |
| Wolfi rolling | logstash-9.3 +2 | 9.3.3-r2 | — |
| Wolfi rolling | logstash-9.4 +1 | 9.4.1-r3 | — |
| Wolfi rolling | solr-10 | 10.0.0-r1 | — |
| Wolfi rolling | sonarqube | 26.7.0.124771-r0 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.2-r11 | — |
| Wolfi rolling | spark-4.1-scala-2.13 | 4.1.1-r15 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.logging.log4j:log4j-core | >= 2.7, < 2.25.4 | 2.25.4 | GHSA-h383-gmxw-35v2 |
| Maven | org.apache.logging.log4j:log4j-core | >= 3.0.0-beta1, <= 3.0.0-beta2 | — | GHSA-h383-gmxw-35v2 |
Advisories 3
- WID-SEC-2026-1067 Apache log4j: Mehrere Schwachstellen ermöglichen Manipulation von Dateien BSI CERT-Bund (WID) · Oct 25, 2026
- WID-SEC-2026-2260 IBM Operational Decision Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 8, 2026
- openSUSE-SU-2026:10544-1 log4j-2.20.0-2.1 on GA media SUSE / openSUSE Security Updates · Apr 15, 2026
References
- https://github.com/apache/logging-log4j2/pull/4078 patch
- https://logging.apache.org/security.html#CVE-2026-34479 vendor-advisory
- https://logging.apache.org/cyclonedx/vdr.xml vendor-advisory
- https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html related
- https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on vendor-advisory