Skip to main content

Apache Log4J Core EUVDEUVD-2026-21408

| CVE-2026-34478 MEDIUM
Incorrect Provision of Specified Functionality (CWE-684)
2026-04-10 apache GHSA-445c-vh5m-36rj
Apache Code Injection Apache Log4J Core Apache Software Foundation
6.9
CVSS 4.0 · Vendor: apache
View

Vulnerability Assessment

Weakness
CWE
CWE-684
ASVS 5.0
V15 - Secure Coding and Architecture Incorrect provision of specified functionality
Impact

CVSS 6.9 reflects network-accessible attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and limited scope integrity impact (SI:L), but no confidentiality or availability damage. The CVSS vector shows no evidence of modified scope exploitation (S:X and modified scores unavailable), suggesting the impact is confined to log output integrity. The core risk depends on deployment context: organizations using Rfc5424Layout directly for stream-based syslog (TCP or TLS) face real log injection risk, potentially enabling log tampering, compliance violations, or downstream system exploitation if logs are parsed without sanitization. However, the majority of Log4j users rely on SyslogAppender, which is not vulnerable. No EPSS score, KEV status, or public proof-of-concept were provided; this limits assessment of immediate exploitation probability. The undocumented attribute renaming is a configuration/usability failure rather than a runtime code execution vulnerability, reducing weaponization likelihood compared to injection or RCE flaws. Real-world risk is elevated for organizations with strict log integrity requirements (financial, healthcare, government) but moderate for general deployments. This is a legitimate priority for affected configurations but lower urgency than critical Log4j RCE vulnerabilities (e.g., Log4Shell).
Exploit ScenarioDerived

An attacker with network access to a Log4j application configured with Rfc5424Layout and TCP or TLS syslog transmission can craft malicious log input containing CRLF sequences (e.g., embedded newlines or carriage returns in user-supplied data). Due to the silent renaming of newLineEscape, the Log4j instance no longer escapes these sequences, allowing the attacker to inject forged syslog headers or messages into the log stream. If the downstream syslog aggregator (e.g., rsyslog, Splunk) parses log entries line-by-line without strict validation, the injected messages may be interpreted as separate legitimate log entries, enabling log tampering, evasion of security monitoring, or spoofing of system events. No public proof-of-concept or active exploitation has been confirmed at time of analysis.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 10, 2026

Apache Log4j Core 2.21.0 through 2.25.3 allows remote log injection via CRLF sequences in Rfc5424Layout due to undocumented renaming of security-relevant configuration attributes (newLineEscape and useTlsMessageFormat). Attackers can inject malicious log entries or downgrade TLS-framed syslog to unframed TCP, compromising log integrity for stream-based syslog services. SyslogAppender users are not affected. CVSS 6.9 indicates medium-to-high severity; EPSS and exploitation signals not available at time of analysis.

RemediationAI

Vendor-released patch: Apache Log4j Core 2.25.4. Users should upgrade to Log4j Core 2.25.4 or later, which restores the original newLineEscape and useTlsMessageFormat attribute names and behavior. For users unable to upgrade immediately, review Rfc5424Layout configuration in log4j2.xml or equivalent configuration files and verify that newLineEscape and useTlsMessageFormat attributes are present and correctly set according to RFC 5424/5425/6587 requirements; if these attributes are missing or renamed in recent upgrades, manually restore them or revert to SyslogAppender (which is unaffected). Detailed remediation guidance is available at https://logging.apache.org/security.html#CVE-2026-34478. The upstream fix (GitHub PR #4074 at https://github.com/apache/logging-log4j2/pull/4074) addresses the attribute naming issue.

Affected VersionsENISA

Apache Log4j Core 3.0.0-beta1 ≤3.0.0-beta3
Apache Log4j Core 2.21.0 <2.25.4

Affected Packages

maven org.apache.logging.log4j:log4j-core fix: 2.25.4
euvd apache_log4j_core fix: 2.25.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Apache Log4j Core's Rfc5424Layout implements RFC 5424 (syslog message format) with support for RFC 6587 (TCP framing) and RFC 5425 (TLS framing) via configuration attributes. The vulnerability stems from CWE-684 (Incorrect Provision of Specified Functionality), specifically the silent renaming of two critical attributes: newLineEscape (controls CRLF escaping for TCP-framed syslog per RFC 6587) and useTlsMessageFormat (controls whether TLS framing per RFC 5425 is applied). When these attributes are renamed without deprecation warnings or documentation updates, users upgrading to Log4j Core 2.21.0+ inadvertently lose newline escaping protection and TLS framing enforcement, reverting to unframed TCP transmission. This allows attackers to inject CRLF sequences into log output, potentially forging syslog messages or causing log injection attacks against downstream syslog aggregation systems. The SyslogAppender wrapper is unaffected because its configuration layer was not modified. CPE cpe:2.3:a:apache_software_foundation:apache_log4j_core:*:*:*:*:*:*:*:* indicates all versions are technically in scope of the CPE, but the vulnerability is specific to versions 2.21.0-2.25.3.

Know when Apache Log4J Core gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Red Hat 5.8 MEDIUM

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
Low
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Apr 10, 2026 - 16:00 nvd
Patch available
CVE Published
Apr 10, 2026 - 15:40 nvd
MEDIUM 6.9

DescriptionCVE.org

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.

Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:

  • The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.
  • The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.

Users of the SyslogAppender are not affected, as its configuration attributes were not modified.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 238 maven packages depend on org.apache.logging.log4j:log4j-core (107 direct, 131 indirect)

Ecosystem-wide dependent count for version 2.21.0.

Threat Intelligence Overview

EPSS Score
0.1%
Top 65% exploitable
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

34
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +34
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Related Vulnerabilities in Apache Log4j Multiple XML Injection and Escaping

View all 4
CVE-2026-34481 MEDIUM
6.3
CVE-2026-34479 MEDIUM
6.9
CVE-2026-34480 MEDIUM
6.9

More in Apache Log4J Core

View all
CVE-2026-34477 MEDIUM POC
6.3 Apr 10

Man-in-the-middle attacks are possible in Apache Log4j Core through 2.25.3 when SMTP, Socket, or Syslog appenders use TL

Same weakness CWE-684 – Incorrect Provision of Specified Functionality

View all
CVE-2024-50357 CRITICAL
9.8
CVE-2023-24845 CRITICAL
9.8
CVE-2026-52735 CRITICAL
9.3
CVE-2026-44597 CRITICAL
9.1
CVE-2024-6425 CRITICAL
9.1
CVE-2023-5363 HIGH
7.5
CVE-2024-5005 MEDIUM POC
4.3
CVE-2025-66384 HIGH
8.2

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
PATCH https://github.com/apache/logging-log4j2/pull/4074 ADVISORY https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt ADVISORY https://logging.apache.org/cyclonedx/vdr.xml ADVISORY https://logging.apache.org/security.html#CVE-2026-34478 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34478 ADVISORY https://vuldb.com/vuln/356843 REF http://www.openwall.com/lists/oss-security/2026/04/10/7 REF https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy