Skip to content

Commit 4420e77

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3pxv-7cmr-fjr4 GHSA-w35j-pv5h-q9q9 GHSA-3pxv-7cmr-fjr4 GHSA-w35j-pv5h-q9q9
1 parent 6e28439 commit 4420e77

4 files changed

Lines changed: 200 additions & 112 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-3pxv-7cmr-fjr4/GHSA-3pxv-7cmr-fjr4.json‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3pxv-7cmr-fjr4",
4+
"modified": "2026-04-10T21:16:41Z",
5+
"published": "2026-04-10T18:31:17Z",
6+
"aliases": [
7+
"CVE-2026-34480"
8+
],
9+
"summary": "Apache Log4j Core's XmlLayout fails to sanitize characters",
10+
"details": "Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.\n\nThe impact depends on the StAX implementation in use:\n\n * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.\n * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.\n\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.logging.log4j:log4j-core"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.0-alpha1"
29+
},
30+
{
31+
"fixed": "2.25.4"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.apache.logging.log4j:log4j-core"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "3.0.0-alpha1"
48+
},
49+
{
50+
"fixed": "3.0.0-beta3"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34480"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/apache/logging-log4j2/pull/4077"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/apache/logging-log4j2"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://logging.apache.org/cyclonedx/vdr.xml"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout"
81+
},
82+
{
83+
"type": "WEB",
84+
"url": "https://logging.apache.org/security.html#CVE-2026-34480"
85+
},
86+
{
87+
"type": "WEB",
88+
"url": "http://www.openwall.com/lists/oss-security/2026/04/10/9"
89+
}
90+
],
91+
"database_specific": {
92+
"cwe_ids": [
93+
"CWE-116"
94+
],
95+
"severity": "MODERATE",
96+
"github_reviewed": true,
97+
"github_reviewed_at": "2026-04-10T21:16:41Z",
98+
"nvd_published_at": "2026-04-10T16:16:31Z"
99+
}
100+
}

‎advisories/github-reviewed/2026/04/GHSA-w35j-pv5h-q9q9/GHSA-w35j-pv5h-q9q9.json‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-w35j-pv5h-q9q9",
4+
"modified": "2026-04-10T21:16:54Z",
5+
"published": "2026-04-10T18:31:18Z",
6+
"aliases": [
7+
"CVE-2026-34481"
8+
],
9+
"summary": "Apache Log4j's JsonTemplateLayout produces invalid JSON output when log events contain non-finite floating-point values",
10+
"details": "Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.\n\nAn attacker can exploit this issue only if both of the following conditions are met:\n\n * The application uses JsonTemplateLayout.\n * The application logs a MapMessage containing an attacker-controlled floating-point value.\n\n\nUsers are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "org.apache.logging.log4j:log4j-layout-template-json"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "2.14.0"
29+
},
30+
{
31+
"fixed": "2.25.4"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Maven",
40+
"name": "org.apache.logging.log4j:log4j-layout-template-json"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "3.0.0-alpha1"
48+
},
49+
{
50+
"fixed": "3.0.0-beta3"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "ADVISORY",
60+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34481"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/apache/logging-log4j2/pull/4080"
65+
},
66+
{
67+
"type": "PACKAGE",
68+
"url": "https://github.com/apache/logging-log4j2"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv"
73+
},
74+
{
75+
"type": "WEB",
76+
"url": "https://logging.apache.org/cyclonedx/vdr.xml"
77+
},
78+
{
79+
"type": "WEB",
80+
"url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html"
81+
},
82+
{
83+
"type": "WEB",
84+
"url": "https://logging.apache.org/security.html#CVE-2026-34481"
85+
},
86+
{
87+
"type": "WEB",
88+
"url": "http://www.openwall.com/lists/oss-security/2026/04/10/10"
89+
}
90+
],
91+
"database_specific": {
92+
"cwe_ids": [
93+
"CWE-116"
94+
],
95+
"severity": "MODERATE",
96+
"github_reviewed": true,
97+
"github_reviewed_at": "2026-04-10T21:16:54Z",
98+
"nvd_published_at": "2026-04-10T16:16:31Z"
99+
}
100+
}

‎advisories/unreviewed/2026/04/GHSA-3pxv-7cmr-fjr4/GHSA-3pxv-7cmr-fjr4.json‎

Lines changed: 0 additions & 56 deletions
This file was deleted.

‎advisories/unreviewed/2026/04/GHSA-w35j-pv5h-q9q9/GHSA-w35j-pv5h-q9q9.json‎

Lines changed: 0 additions & 56 deletions
This file was deleted.

0 commit comments

Comments
 (0)