Apache Apache Log4j Core
4 CVEs affecting Apache Apache Log4j Core. Latest disclosed: 2026-04-10. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34480 | High | 7.5 | 2026-04-10 | Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize c… |
CVE-2026-34478 | High | 7.5 | 2026-04-10 | Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to… |
CVE-2026-34477 | Medium | 5.9 | 2026-04-10 | The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via t… |
CVE-2025-68161 | Medium | 4.8 | 2025-12-18 | The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the v… |