High severity · published Apr 10, 2026
CVE-2026-34479
Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.
Two groups of users are affected:
* Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file.
* Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.
Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.
Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
Log4j · Apache
2.7 before 2.25.4; 3.0.0; 3.0.0; 3.0.0; 3.0.0; 3.0.0 · source: NVD
AL
Apache Log4j 1 to Log4j 2 bridge · Apache Software Foundation
2.7 before 2.25.4; 3.0.0-alpha1 through 3.0.0-beta2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34479
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34479
Exploit
https://github.com/apache/logging-log4j2/pull/4078
Mailing List
https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on
Vendor Advisory
https://logging.apache.org/cyclonedx/vdr.xml
Mitigation
https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html
Vendor Advisory
https://logging.apache.org/security.html#CVE-2026-34479
Mailing List
http://www.openwall.com/lists/oss-security/2026/04/10/8
More from Log4j
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
9.0
CVE-2021-45046
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
9.8
CVE-2022-23305
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout
9.8
CVE-2020-9493
Java deserialization in Chainsaw
9.8
CVE-2019-17571
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with…