CVE-2026-34480

{"id": "CVE-2026-34480", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34480", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T17:43:51.255638Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"cpes": ["cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*"], "vendor": "Apache Software Foundation", "product": "Apache Log4j Core", "versions": [{"status": "affected", "version": "2.0-alpha1", "lessThan": "2.25.4", "versionType": "maven"}, {"status": "affected", "version": "3.0.0-alpha1", "versionType": "maven", "lessThanOrEqual": "3.0.0-beta3"}], "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-core", "packageName": "org.apache.logging.log4j:log4j-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-04-10T16:16:31.463", "references": [{"url": "https://github.com/apache/logging-log4j2/pull/4077", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://logging.apache.org/cyclonedx/vdr.xml", "tags": ["Product"], "source": "security@apache.org"}, {"url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout", "tags": ["Technical Description"], "source": "security@apache.org"}, {"url": "https://logging.apache.org/security.html#CVE-2026-34480", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/10/9", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output."}, {"lang": "es", "value": "El XmlLayout de Apache Log4j Core https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , en versiones hasta la 2.25.3 inclusive, no logra sanear los caracteres prohibidos por la especificaci\u00f3n XML 1.0 https://www.w3.org/TR/xml/#charsets produciendo una salida XML no v\u00e1lida cada vez que un mensaje de registro o un valor MDC contiene dichos caracteres.\n\nEl impacto depende de la implementaci\u00f3n de StAX en uso:\n\n * StAX integrado en JRE: Los caracteres prohibidos se escriben silenciosamente en la salida, produciendo XML malformado. Los analizadores conformes deben rechazar dichos documentos con un error fatal, lo que puede hacer que los sistemas de procesamiento de registros posteriores descarten los registros afectados.\n * Implementaciones alternativas de StAX (por ejemplo, Woodstox https://github.com/FasterXML/woodstox , una dependencia transitiva del m\u00f3dulo Jackson XML Dataformat): Se lanza una excepci\u00f3n durante la llamada de registro, y el evento de registro nunca se entrega a su appender previsto, solo al registrador de estado interno de Log4j.\n\nSe recomienda a los usuarios actualizar a Apache Log4j Core 2.25.4, que corrige este problema saneando los caracteres prohibidos antes de la salida XML."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB58E4E0-0D2E-4565-9436-5191B31DEB6B", "versionEndExcluding": "2.25.4", "versionStartIncluding": "2.0"}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5EE518C3-2F43-40FF-B754-C340B7003FC7"}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D2A01C1-D56C-4198-8ADB-11739F791E2B"}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6F8BD61-DD30-4D64-842C-850E5B117036"}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED00C38D-27EA-489C-9A2B-3594ACA8A3C5"}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8794D719-1D90-4378-B48B-698EA40FBFB2"}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74C9FCBD-ECAD-4C29-B97A-2B9D97C0FC1F"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}