7.5

CVE-2026-34478

Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility

Apache Log4j Core's  Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.

Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:

  *  The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.
  *  The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.


Users of the SyslogAppender are not affected, as its configuration attributes were not modified.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Log4j Version >= 2.21.0 < 2.25.4
Apache ≫ Log4j Version3.0.0 Updatebeta1
Apache ≫ Log4j Version3.0.0 Updatebeta2
Apache ≫ Log4j Version3.0.0 Updatebeta3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.83% 0.527
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
security@apache.org 6.9 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-117 Improper Output Neutralization for Logs

The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

CWE-684 Incorrect Provision of Specified Functionality

The code does not function according to its published specifications, potentially leading to incorrect usage.

https://logging.apache.org/cyclonedx/vdr.xml
Product
https://github.com/apache/logging-log4j2/pull/4074
Patch
Issue Tracking
https://logging.apache.org/security.html#CVE-2026-34478
Vendor Advisory
https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout
Technical Description
https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt
Vendor Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2026/04/10/7
Third Party Advisory
Mailing List