What is CVE-2026-34477?

CVE-2026-34477 is a medium-severity vulnerability in Apache Log4j, classified under Improper Validation of Certificate with Host Mismatch. CVSS score: 5.9/10. Published 2026-04-10.

How severe is CVE-2026-34477?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Apache Log4j

CVE-2026-34477

The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemp…

EPSS: 0.000 (8.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Apache Log4j — versions 3.0.0
Apache Software Foundation Log4j Core — versions 2.12.0, 3.0.0-alpha1

Weakness classification (CWE)

References

security@apache.org (Patch, patch, Issue Tracking)
security@apache.org (vendor-advisory, Vendor Advisory)
security@apache.org (vendor-advisory, Vendor Advisory)
security@apache.org (related, Product)
security@apache.org (vendor-advisory, Mailing List)

Frequently asked questions

What is CVE-2026-34477?: CVE-2026-34477 is a medium-severity vulnerability in Apache Log4j, classified under Improper Validation of Certificate with Host Mismatch. CVSS score: 5.9/10. Published 2026-04-10.
How severe is CVE-2026-34477?: Medium severity. CVSS v3 base score is 5.9 out of 10.