Skip to main content

Apache Log4J 1 To Log4J 2 Bridge EUVDEUVD-2026-21409

| CVE-2026-34479 MEDIUM
Improper Encoding or Escaping of Output (CWE-116)
2026-04-10 apache GHSA-h383-gmxw-35v2
Apache Information Disclosure Apache Log4J 1 To Log4J 2 Bridge Apache Software Foundation
6.9
CVSS 4.0 · Vendor: apache
View

Vulnerability Assessment

Weakness
CWE
CWE-116
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding for downstream
Impact

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N) indicates network-accessible, low-complexity, unauthenticated exploitation with limited impact to information integrity and no direct confidentiality or availability compromise to the Log4j component itself. The CVSS score of 6.9 reflects medium-range severity. However, real-world risk is amplified by indirect consequences: downstream systems that depend on valid XML logs experience availability degradation (dropped records, indexing failures) and integrity issues (incomplete audit trails, compliance violations). The information disclosure tag suggests that malformed logs could leak system information to downstream systems attempting error recovery. No public exploit code or active exploitation (KEV status) is evident from provided data, suggesting this is primarily an operational integrity issue rather than an active attack vector. Organizations with strict XML-dependent log processing pipelines face higher operational risk than those with lenient parsers. The deprecation notice in the advisory is significant-this bridge receives limited future support, incentivizing rapid migration rather than long-term patching.
Exploit ScenarioDerived

An application using Log4j1XmlLayout processes user-supplied data or system-generated log messages containing control characters (such as NULL, STX, or other forbidden XML 1.0 characters) and writes them to XML log output. A downstream SIEM or log aggregation system attempts to parse the malformed XML, encounters a fatal XML parsing error, and silently drops the entire log record or halts indexing of that log batch. An attacker could exploit this by injecting such characters into application logs (e.g., via user input that is logged), causing security-relevant log entries to be lost or unindexed, thereby obfuscating their malicious activities from audit and detection systems. No public proof-of-concept exploit code is currently available, and no active exploitation has been confirmed; however, the attack requires only network access to trigger log generation and is trivially reproducible by anyone familiar with XML 1.0 restrictions.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 10, 2026

Log4j1XmlLayout in Apache Log4j 1-to-Log4j 2 bridge fails to escape XML 1.0-forbidden characters, causing malformed XML output that conforming XML parsers reject with fatal errors. This impacts downstream log processing systems that may drop or fail to index affected log records, affecting organizations using either Log4j1XmlLayout directly in Log4j Core 2 configurations or the deprecated Log4j 1 compatibility layer with XMLLayout. While no active exploitation has been confirmed, the vulnerability has a notable EPSS score and affects information disclosure integrity. Vendor-released patch version 2.25.4 is available.

RemediationAI

Vendor-released patch: Upgrade Apache Log4j 1-to-Log4j 2 bridge to version 2.25.4 or later. Organizations using Log4j Core 2 should update their Log4j 2 dependency to a version containing the patched bridge (version 2.25.4 or later). For long-term resilience, Apache strongly recommends migrating away from the deprecated Log4j 1-to-Log4j 2 bridge entirely by refactoring legacy Log4j 1 configurations to native Log4j 2 configurations; consult the migration guide at https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html for detailed migration steps. Interim workaround: If immediate upgrade is not feasible, disable XML-based logging or switch to JSON, CSV, or plaintext layouts that do not require XML 1.0 conformance. Validate that downstream log processing systems can successfully ingest logs after patching. Full advisory details and discussion are available at https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on.

Affected VersionsENISA

Apache Log4j 1 to Log4j 2 bridge 3.0.0-alpha1 ≤3.0.0-beta2
Apache Log4j 1 to Log4j 2 bridge 2.7 <2.25.4

Affected Packages

maven org.apache.logging.log4j:log4j-1.2-api fix: 2.25.4
maven org.apache.logging.log4j:log4j-core fix: 2.25.4
euvd apache_log4j_1_to_log4j_2_bridge fix: 2.25.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The Log4j 1-to-Log4j 2 bridge (CPE: cpe:2.3:a:apache_software_foundation:apache_log4j_1_to_log4j_2_bridge) provides backward compatibility for legacy Log4j 1 configurations by adapting them to Log4j 2's architecture. Log4j1XmlLayout is the XML formatting component within this bridge. The vulnerability stems from improper input validation and encoding (CWE-116: Improper Encoding or Escaping of Output). When the layout encounters characters forbidden by the XML 1.0 specification (certain control characters and invalid Unicode sequences), it fails to sanitize them before writing to XML output. XML 1.0 parsers, per W3C standards, treat such characters as fatal errors, causing parsers to reject the entire document. This is particularly problematic in operational environments where log aggregation systems, security information and event management (SIEM) platforms, and compliance logging frameworks depend on valid XML for indexing, correlation, and archival.

Know when Apache Log4J 1 To Log4J 2 Bridge gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY 6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat 5.3 MEDIUM

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
Low
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Apr 10, 2026 - 16:00 nvd
Patch available
CVE Published
Apr 10, 2026 - 15:41 nvd
MEDIUM 6.9

DescriptionCVE.org

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

Two groups of users are affected:

  • Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.
  • Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.

Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.

Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 197 maven packages depend on org.apache.logging.log4j:log4j-1.2-api (174 direct, 23 indirect)
  • 1,177 maven packages depend on org.apache.logging.log4j:log4j-core (668 direct, 517 indirect)

Ecosystem-wide dependent count for version 2.7 and other introduced versions.

Threat Intelligence Overview

EPSS Score
0.1%
Top 69% exploitable
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

34
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +34
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Apache Log4j Multiple XML Injection and Escaping

View all 4
CVE-2026-34478 MEDIUM
6.9
CVE-2026-34481 MEDIUM
6.3
CVE-2026-34480 MEDIUM
6.9

Same weakness CWE-116 – Improper Encoding or Escaping of Output

View all
CVE-2013-4547 HIGH POC
7.5
CVE-2026-20245 HIGH POC
7.8
CVE-2022-36446 CRITICAL POC
9.8
CVE-2017-8303 CRITICAL POC
9.8
CVE-2022-30781 HIGH POC
7.5
CVE-2023-46301 CRITICAL POC
9.8
CVE-2023-46300 CRITICAL POC
9.8
CVE-2022-41443 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

References

Advisories & patches
PATCH https://github.com/apache/logging-log4j2/pull/4078 ADVISORY https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on ADVISORY https://logging.apache.org/cyclonedx/vdr.xml ADVISORY https://logging.apache.org/security.html#CVE-2026-34479 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-34479 ADVISORY https://vuldb.com/vuln/356838 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-34479 REF http://www.openwall.com/lists/oss-security/2026/04/10/8 REF https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy