CVE-2026-40023 Other in Apache Log4cxx

Medium 6.3 Published 10 Apr 2026 Updated 10 Apr 2026

Attackers can suppress log records by injecting forbidden XML characters, impairing audit trails and detection in applications using Apache Log4cxx.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-40023?

CVE-2026-40023 is a medium-severity vulnerability in Apache Log4cxx, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.

Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.

Weakness: CWE-116

Which versions are affected by CVE-2026-40023?

It affects 1 product.

Linux distribution packages (1)

log4cxx openSUSE:Tumbleweed All versions 1.7.0-2.1

Products include Apache Log4cxx.

How do I fix CVE-2026-40023?

Upgrade to a fixed version.

Is CVE-2026-40023 being exploited?

There is no known exploitation of CVE-2026-40023 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-40023, GHSA-q8qr-wp2r-738r, MGASA-2026-0218, UBUNTU-CVE-2026-40023, openSUSE-SU-2026:10566-1, openSUSE-SU-2026:20705-1.