{"action":"Upgrade log4cxx to 1.4.0-1+deb13u1 or later.","affected":[{"fixed":"1.4.0-1+deb13u1","introduced":"0"}],"component":"log4cxx","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1.4.0-1+deb13u1"],"id":"tcs_01M5NP1Y267Q542KKTPYMCW4ME","modified_at":"2026-09-01T20:05:54.526193630Z","published_at":"2025-08-22T19:15:39.803Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-54812","https://security-tracker.debian.org/tracker/CVE-2025-54812"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-54812#Debian:13/log4cxx","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-54812"}],"summary":"Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file. If untrusted data is used to re"}