Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Apache Log4j Core 2.25.4 Clear all filters
TI-2026-26738 CVE-2026-34480 · GHSA-3pxv-7cmr-fjr4

Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

Priority LOW 39

Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01064 Published 2026-04-10 Partial fix · 2.25.4 CWE-116
TI-2026-26736 CVE-2026-34478 · GHSA-445c-vh5m-36rj

Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility

Priority LOW 38

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00989 Published 2026-04-10 Partial fix · 2.25.4 CWE-117
TI-2026-26735 CVE-2026-34477 · GHSA-6hg6-v5c8-fphq

Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass

Priority LOW 29

The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00569 Published 2026-04-10 Partial fix · 2.25.4 CWE-297