{"action":"Upgrade log4cxx to 1.0.0-1+deb12u1 or later.","affected":[{"fixed":"1.0.0-1+deb12u1","introduced":"0"}],"component":"log4cxx","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["1.0.0-1+deb12u1"],"id":"tcs_01M5NP1XYNVCYJKHH2DHC49MMC","modified_at":"2026-09-01T20:05:54.526193630Z","published_at":"2025-08-22T19:15:39.803Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-54812","https://security-tracker.debian.org/tracker/CVE-2025-54812"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-54812","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-54812"}],"summary":"Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file. If untrusted data is used to re"}