Vulnerability in Apache Log4cxx
CVE-2025-54812
Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file. If untrusted data is used to retrieve the name of a logger, an attac…
EPSS: 0.011 (61.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Apache Log4cxx
- Apache Software Foundation Log4cxx — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, Vendor Advisory)
- security@apache.org (Patch, patch, Issue Tracking)
- security@apache.org (Patch, patch, Issue Tracking)
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-54812?
- CVE-2025-54812 is a medium-severity vulnerability in Apache Log4cxx, classified under Improper Output Neutralization for Logs. CVSS score: 5.4/10. Published 2025-08-22.
- How severe is CVE-2025-54812?
- Medium severity. CVSS v3 base score is 5.4 out of 10.
- Is CVE-2025-54812 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.