CVE-2026-34479 Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

What is CVE-2026-34479?

CVE-2026-34479 is a medium-severity vulnerability in Apache Log4j 1 to Log4j 2 bridge, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

Two groups of users are affected:

* Those using Log4j1XmlLayout directly in a Log4j Core 2 configuration file. * Those using the Log4j 1 configuration compatibility layer with org.apache.log4j.xml.XMLLayout specified as the layout class.

Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version 2.25.4, which corrects this issue.

Note: The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the Log4j 1 to Log4j 2 migration guide https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html , and specifically the section on eliminating reliance on the bridge.

Weakness: CWE-116

Which versions are affected by CVE-2026-34479?

4 open source packages ship an affected version, including org.apache.logging.log4j:log4j-core. It affects 1 product.

Products include Apache Log4j.

How do I fix CVE-2026-34479?

Upgrade org.apache.logging.log4j:log4j-core to 2.25.4 or later.

Is CVE-2026-34479 being exploited?

There is no known exploitation of CVE-2026-34479 in the wild and no public exploit code.

Other vulnerabilities in Apache Log4j 1 to Log4j 2 bridge

• CVE-2021-44228 Apache Log4j2 Remote Code Execution Exploited Critical 10.0
• CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data Exploited Critical 9.0
• CVE-2022-23305 SQL injection in JDBC Appender in Apache Log4j V1 Critical 9.8
• CVE-2017-5645 Deserialization of Untrusted Data in Log4j Critical 9.8
• CVE-2022-23302 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-LD36349, CLEANSTART-2026-NL43370, CLEANSTART-2026-RP42469, CLEANSTART-2026-VX38000, CLSA-2026-1779124827, CLSA-2026-1780054786 and 70 more.