CVE-2025-54813 Apache Log4cxx: Improper escaping with JSONLayout

Medium 6.3 Published 22 Aug 2025 Updated 4 Nov 2025

Attackers can inject non-printable characters into JSON logs, potentially causing downstream log consumers to fail parsing or process data incorrectly.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-54813?

CVE-2025-54813 is a medium-severity vulnerability in Apache Log4cxx, published on 22 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.

When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.

This issue affects Apache Log4cxx: before 1.5.0.

Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Weakness: CWE-117

Which versions are affected by CVE-2025-54813?

It affects 1 product.

Products include Apache Log4cxx.

How do I fix CVE-2025-54813?

Upgrade to a fixed version.

Is CVE-2025-54813 being exploited?

There is no known exploitation of CVE-2025-54813 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2025-54813, GHSA-68p3-h5c2-5hcr, UBUNTU-CVE-2025-54813.