Apache CVE-2026-40023

Apache Log4cxx is a C++ logging library implementing XML-based log output through its XMLLayout component. The XML 1.0 specification (W3C TR-xml) defines a restricted character set; specifically, characters in the range 0x00-0x08, 0x0B-0x0C, 0x0E-0x1F, and unpaired surrogates are forbidden in XML documents. XMLLayout formats log records as XML elements but did not validate or escape these forbidden characters when rendering message content, NDC stacks, or MDC property key-value pairs. When a log entry contains such characters, the generated XML becomes non-well-formed. Any XML 1.0 compliant parser (DOM, SAX, or streaming) must reject the document with a fatal parse error per XML specification section 4.2 (Well-Formedness Constraints). This causes downstream log processing pipelines-SIEM systems, log aggregators (ELK, Splunk, etc.), or indexing services-to silently drop or fail-parse affected records. The root cause is improper input validation and encoding (CWE-116: Improper Encoding or Escaping of Output). This is distinct from XML injection (CWE-91) because it does not exploit parser state machines but rather violates the character set specification itself.