What is CVE-2026-34479?

CVE-2026-34479 is a high-severity vulnerability in Apache Log4j, classified under Improper Encoding or Escaping of Output. CVSS score: 7.5/10. Published 2026-04-10.

How severe is CVE-2026-34479?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Apache Log4j

CVE-2026-34479

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. Two groups of users are affected: * Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class. Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue. Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.

Published 2026-04-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

EPSS exploit prediction

EPSS: 0.009 (59.3th percentile), scored 2026-10-20.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 59.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.009 · change: +0.004

Affected products

Apache Log4j — versions 3.0.0
Apache Software Foundation Log4j 1 To 2 Bridge — versions 2.7, 3.0.0-alpha1

Weakness classification (CWE)

CWE-116 — Improper Encoding or Escaping of Output

References

github.com/apache/logging-log4j2/pull/4078 (Exploit, Patch, patch, Issue Tracking)
logging.apache.org/security.html (vendor-advisory, Vendor Advisory)
logging.apache.org/cyclonedx/vdr.xml (vendor-advisory, Vendor Advisory)
logging.apache.org/log4j/2.x/migrate-from-log4j1.html (related, Mitigation)
lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on (vendor-advisory, Mailing List)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List)

Frequently asked questions

What is CVE-2026-34479?: CVE-2026-34479 is a high-severity vulnerability in Apache Log4j, classified under Improper Encoding or Escaping of Output. CVSS score: 7.5/10. Published 2026-04-10.
How severe is CVE-2026-34479?: High severity. CVSS v3 base score is 7.5 out of 10.