Read the docs
TI-2025-34567 Aliases CVE-2025-54813GHSA-68p3-h5c2-5hcr

Apache Log4cxx: Improper escaping with JSONLayout

Priority LOW 37CWE-117Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0135 71st percentileScored 2026-11-07
Fix Partial Apache Log4cxx (Apache Software Foundation): 1.5.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Log4cxx0.11.0 to before 1.5.01.5.0Patch availableCNA
  • Apache Log4cxx VendorApache Affected 0.11.0 to before 1.5.0 Fixed in 1.5.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:log4cxx:*:*:*:*:*:*:*:*before 1.5.0VulnerableApache
  • cpe:2.3:a:apache:log4cxx:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Log4cxx (Apache Software Foundation) Fixed in 1.5.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Log4cxx 1.5.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-34566 Apache Log4cxx: Improper HTML escaping in HTMLLayoutPriority LOW 14
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54813
  2. 2026-10-03 Alias added: GHSA-68p3-h5c2-5hcr

References

Patch 1

Advisory 1

  • TI-2023-14775 Apache Log4cxx: SQL injection when using ODBC appender CVSS 3.1HIGH 8.8
  • TI-2026-28866 Improper output encoding in Apache Log4cxx CVSS 4.0MEDIUM 6.3
  • TI-2025-34566 Apache Log4cxx: Improper HTML escaping in HTMLLayout CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences