Apache Log4j Core vulnerabilities

2 known vulnerabilities in Apache Log4j Core from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache Log4j Core: Improper Encoding or Escaping of Output

  CVE-2026-34480Apr 10, 2026ApacheEPSS 1.06%

  Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid

• 7.5 High severity

  Apache Log4j Core: Improper Output Neutralization for Logs

  CVE-2026-34478Apr 10, 2026Apache

  Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attri