CVE-2026-34479
1 advisory.
Maven/org.apache.logging.log4j:log4j-1.2-api CVE-2026-34479: medium
Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
Action: Upgrade org.apache.logging.log4j:log4j-1.2-api to 2.25.4 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.7 | 2.25.4 | - |
| 3.0.0-beta1 | - | 3.0.0-beta2 |
Fixed versions
| 2.25.4 |
Sources
- osv: GHSA-h383-gmxw-35v2
- https://nvd.nist.gov/vuln/detail/CVE-2026-34479
- https://github.com/apache/logging-log4j2/pull/4078
- https://github.com/apache/logging-log4j2
- https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on
- https://logging.apache.org/cyclonedx/vdr.xml
- https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html
- https://logging.apache.org/security.html#CVE-2026-34479
- http://www.openwall.com/lists/oss-security/2026/04/10/8
CVE-2026-34479 · published · modified · JSON