{"action":"Upgrade log4cxx to 1.4.0-1.1 or later.","affected":[{"fixed":"1.4.0-1.1","introduced":"0"}],"component":"log4cxx","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["1.4.0-1.1"],"id":"tcs_01M5NP1Y64T4H9MCEVD0P9SFQX","modified_at":"2026-09-01T20:05:54.526193630Z","published_at":"2025-08-22T19:15:39.803Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-54812","https://security-tracker.debian.org/tracker/CVE-2025-54812"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-54812#Debian:14/log4cxx","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-54812"}],"summary":"Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file. If untrusted data is used to re"}