Read the docs
TI-2025-34566 Aliases CVE-2025-54812GHSA-7mpr-gcjx-jcmw

Apache Log4cxx: Improper HTML escaping in HTMLLayout

Priority LOW 14CWE-117Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file. If untrusted data is used to retrieve the name of a logger, an attacker could theoretically inject HTML or Javascript in order to hide information from logs or steal data from the user. In order to activate this, the following sequence must occur: * Log4cxx is configured to use HTMLLayout. * Logger name comes from an untrusted string * Logger with compromised name logs a message * User opens the generated HTML log file in their browser, leading to potential XSS Because logger names are generally constant strings, we assess the impact to users as LOW This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01238 69th percentileScored 2026-11-07
Fix Partial Apache Log4cxx (Apache Software Foundation): 1.5.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Log4cxxbefore 1.5.01.5.0Patch availableCNA
  • Apache Log4cxx VendorApache Affected before 1.5.0 Fixed in 1.5.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:log4cxx:*:*:*:*:*:*:*:*before 1.5.0VulnerableApache
  • cpe:2.3:a:apache:log4cxx:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Log4cxx (Apache Software Foundation) Fixed in 1.5.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Log4cxx 1.5.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-34567 Apache Log4cxx: Improper escaping with JSONLayoutPriority LOW 37
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54812
  2. 2026-10-03 Alias added: GHSA-7mpr-gcjx-jcmw

References

Patch 2

Advisory 1

  • TI-2023-14775 Apache Log4cxx: SQL injection when using ODBC appender CVSS 3.1HIGH 8.8
  • TI-2025-34567 Apache Log4cxx: Improper escaping with JSONLayout CVSS 4.0MEDIUM 6.3
  • TI-2026-28866 Improper output encoding in Apache Log4cxx CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences