Apache Log4cxx vulnerabilities

2 known vulnerabilities in Apache Log4cxx from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache Log4cxx: Improper Output Neutralization for Logs

  CVE-2025-54813Aug 22, 2025ApacheEPSS 1.5%

  Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and

• 8.8 High severity

  Apache Log4cxx: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-31038May 8, 2023ApacheEPSS 1.6%

  SQL injection in Log4cxx when using the ODBC appender to send log messages to a database. No fields sent to the database were properly escaped for SQL injection. This has been the case since at least version 0.9.0(released 2003-08-06) Note that Log4cxx is a C+