CVE-2026-34479: Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
Two groups of users are affected:
Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.
Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.
Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34479?
CVE-2026-34479 is considered a moderate severity vulnerability due to the risk of data loss and malformed log output.
How do I fix CVE-2026-34479?
To fix CVE-2026-34479, update the Apache Log4j 1-to-Log4j 2 bridge to a version beyond 2.25.4.
What software is affected by CVE-2026-34479?
CVE-2026-34479 affects the Apache Log4j 1-to-Log4j 2 bridge versions prior to 2.25.4.
What is the impact of CVE-2026-34479?
The impact of CVE-2026-34479 includes silent log event loss due to the output of malformed XML.
Is CVE-2026-34479 a critical vulnerability?
CVE-2026-34479 is not classified as critical, it is deemed moderate due to the nature of the log event loss.