TI-2026-26735 Aliases CVE-2026-34477 GHSA-6hg6-v5c8-fphq

Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass

LOW 29CWE-297Published 2026-04-10 · Updated 2026-04-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: Spoofing
Confidentiality · integrity · availability: Low · None · None
Fix status: Partial Red Hat: 1 fixed, 20 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element. Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value. A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met: * An SMTP, Socket, or Syslog appender is in use. * TLS is configured via a nested <Ssl> element. * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00569 47th percentileScored 2026-11-07

Fix Partial Apache Log4j Core (Apache Software Foundation): 2.25.4org.apache.logging.log4j:log4j-core (Maven): 2.25.4Red Hat: 1 advisoryRed Hat: 1 fixed, 20 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Log4j Core	2.12.0 to before 2.25.4; 3.0.0-alpha1 – 3.0.0-beta3	2.25.4	Patch available	CNA
—	org.apache.logging.log4j:log4j-core (Maven)	2.12.0 to before 2.25.4	2.25.4	Patch available	GHSA-6hg6-v5c8-fphq
—	org.apache.logging.log4j:log4j-core (Maven)	3.0.0-alpha1 – 3.0.0-beta3	—	No fix listed	GHSA-6hg6-v5c8-fphq

Apache Log4j Core VendorApache Affected 2.12.0 to before 2.25.4; 3.0.0-alpha1 – 3.0.0-beta3 Fixed in 2.25.4 Patch available CNA
org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected 2.12.0 to before 2.25.4 Fixed in 2.25.4 Patch available GHSA-6hg6-v5c8-fphq
org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected 3.0.0-alpha1 – 3.0.0-beta3 Fixed in — No fix listed GHSA-6hg6-v5c8-fphq

CPE configurations NVD · 7

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:log4j::::::::	2.12.0 to before 2.25.4	Vulnerable	Apache
cpe:2.3:a:apache:log4j:3.0.0:alpha1::::::	3.0.0 alpha1	Vulnerable	Apache
cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1::::::	3.0.0 alpha1_rc1	Vulnerable	Apache
cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2::::::	3.0.0 alpha1_rc2	Vulnerable	Apache
cpe:2.3:a:apache:log4j:3.0.0:beta1::::::	3.0.0 beta1	Vulnerable	Apache
cpe:2.3:a:apache:log4j:3.0.0:beta2::::::	3.0.0 beta2	Vulnerable	Apache
cpe:2.3:a:apache:log4j:3.0.0:beta3::::::	3.0.0 beta3	Vulnerable	Apache

cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* Versions 2.12.0 to before 2.25.4 Vulnerable ·Apache
cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:* Versions 3.0.0 alpha1 Vulnerable ·Apache
cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:* Versions 3.0.0 alpha1_rc1 Vulnerable ·Apache
cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:* Versions 3.0.0 alpha1_rc2 Vulnerable ·Apache
cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:* Versions 3.0.0 beta1 Vulnerable ·Apache
cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Vulnerable ·Apache
cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:* Versions 3.0.0 beta3 Vulnerable ·Apache

Remediation

Fix · CNA Apache Log4j Core (Apache Software Foundation) Fixed in 2.25.4
Fix · GHSA-6hg6-v5c8-fphq org.apache.logging.log4j:log4j-core (Maven) Fixed in 2.25.4 Advisory →

Red Hat 1 advisory

RHSA-2026:21773 Released 2026-05-28 · Red Hat rating Important
Red Hat Offline Knowledge Portal security and content update
- Red Hat Offline Knowledge Portal 1.2.13 registry.redhat.io/offline-knowledge-portal/rhokp-rhel9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-04-10
Apache Log4j Core 2.25.4
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-26738 Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden charactersPriority LOW 39
- TI-2026-26736 Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibilityPriority LOW 38
Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat AI Inference Server	Affected	No fix yet: Fix deferred
Red Hat AMQ Broker 7	Affected	No fix yet: Fix deferred
Red Hat Data Grid 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux AI (RHEL AI) 3	Affected	No fix yet: Fix deferred
Red Hat Fuse 7	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 7	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform 8	Affected	No fix yet: Fix deferred
Red Hat JBoss Enterprise Application Platform Expansion Pack	Affected	No fix yet: Fix deferred
Red Hat JBoss Web Server 6	Affected	No fix yet: Fix deferred
Red Hat Offline Knowledge Portal	Affected	No fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel - HawtIO 4	Affected	No fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4	Affected	No fix yet: Fix deferred
Red Hat build of Apicurio Registry 2	Affected	No fix yet: Fix deferred
Red Hat build of Apicurio Registry 3	Affected	No fix yet: Fix deferred
Red Hat build of OptaPlanner 8	Affected	No fix yet: Fix deferred
streams for Apache Kafka 2	Affected	No fix yet: Fix deferred
streams for Apache Kafka 3	Affected	No fix yet: Fix deferred
Red Hat Offline Knowledge Portal 1.2.13	Fixed	RHSA-2026:21773

Timeline

2026-10-02 Threatist record created from CVE-2026-34477
2026-10-03 Alias added: GHSA-6hg6-v5c8-fphq

References

Patch 1

https://github.com/apache/logging-log4j2/pull/4075

Advisory 4

Other 2

TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
TI-2021-20393 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack KEVCVSS 3.1CRITICAL 9.0
TI-2017-03645 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
TI-2019-13113 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
TI-2022-07428 SQL injection in JDBC Appender in Apache Log4j V1 CVSS 3.1CRITICAL 9.8
TI-2022-07425 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x CVSS 3.1HIGH 8.8

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences