{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2025-54813 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2025-54813 is a medium-severity vulnerability in Apache Log4cxx, published on 22 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-54813 and fix it if it is affected.\n\nWhat it is: CVE-2025-54813 is a medium-severity vulnerability in Apache Log4cxx, published on 22 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-54813 in the wild and no public exploit code.\n\nAffected product: Apache Log4cxx. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-54813/ (Markdown: https://insights.sbomify.com/CVE-2025-54813/index.md)","id":"CVE-2025-54813","markdown":"https://insights.sbomify.com/CVE-2025-54813/index.md","name":"CVE-2025-54813","record":{"aliases":["DEBIAN-CVE-2025-54813","GHSA-68p3-h5c2-5hcr","UBUNTU-CVE-2025-54813"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"C++ logging library","requires_auth":"none","summary":"Attackers can inject non-printable characters into JSON logs, potentially causing downstream log consumers to fail parsing or process data incorrectly.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"log4cxx","vendor":"apache"}],"cvss":{"score":6.3,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","version":"4.0"},"cwes":[{"id":"CWE-117","name":"Improper Output Neutralization for Logs"}],"description":"Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.\n\nWhen using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.\n\nThis issue affects Apache Log4cxx: before 1.5.0.\n\nUsers are recommended to upgrade to version 1.5.0, which fixes the issue.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Apache Log4cxx: Improper escaping with JSONLayout","id":"CVE-2025-54813","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"other","year":"2025"},"n_packages":0,"n_references":2,"next":{"headline":"Cross-site scripting in MedDream PACS Premium","id":"CVE-2025-54814"},"packages":[],"prev":{"headline":"Apache Log4cxx: Improper HTML escaping in HTMLLayout","id":"CVE-2025-54812"},"products":["Apache Log4cxx"],"published":"2025-08-22","related":[{"cvss_score":8.8,"headline":"Apache Log4cxx: SQL injection when using ODBC appender","id":"CVE-2023-31038","kev_date_added":null,"published":"2023-05-08"},{"cvss_score":6.3,"headline":"Other in Apache Log4cxx","id":"CVE-2026-40023","kev_date_added":null,"published":"2026-04-10"},{"cvss_score":2.1,"headline":"Apache Log4cxx: Improper HTML escaping in HTMLLayout","id":"CVE-2025-54812","kev_date_added":null,"published":"2025-08-22"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-11-04","vendors":["Apache Software Foundation"]},"summary":"Attackers can inject non-printable characters into JSON logs, potentially causing downstream log consumers to fail parsing or process data incorrectly.","url":"https://insights.sbomify.com/CVE-2025-54813/"}