CVE-2026-34478

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34478", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-28T13:17:35.586Z", "datePublished": "2026-04-10T15:40:17.713Z", "dateUpdated": "2026-04-10T17:50:12.484Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "cpes": ["cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "org.apache.logging.log4j:log4j-core", "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-core", "product": "Apache Log4j Core", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.25.4", "status": "affected", "version": "2.21.0", "versionType": "maven"}, {"lessThanOrEqual": "3.0.0-beta3", "status": "affected", "version": "3.0.0-beta1", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Samuli Leinonen"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Apache Log4j Core's <code><a target=\"_blank\" rel=\"nofollow\" href=\"https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout\">Rfc5424Layout</a></code>, in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.</p><p>Two distinct issues affect users of stream-based syslog services who configure <code>Rfc5424Layout</code> directly:</p><ul><li>The <code>newLineEscape</code> attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.</li><li>The <code>useTlsMessageFormat</code> attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.</li></ul><p>Users of the <code>SyslogAppender</code> are not affected, as its configuration attributes were not modified.</p><p>Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</p>"}], "value": "Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.\n\nTwo distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:\n\n * The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.\n * The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.\n\n\nUsers of the SyslogAppender are not affected, as its configuration attributes were not modified.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-684", "description": "CWE-684 Incorrect Provision of Specified Functionality", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-117", "description": "CWE-117 Improper Output Neutralization for Logs", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-10T15:40:17.713Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/logging-log4j2/pull/4074"}, {"tags": ["vendor-advisory"], "url": "https://logging.apache.org/security.html#CVE-2026-34478"}, {"tags": ["vendor-advisory"], "url": "https://logging.apache.org/cyclonedx/vdr.xml"}, {"tags": ["related"], "url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt"}], "source": {"discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2025-12-25T12:58:00.000Z", "value": "Vulnerability reported by Samuli Leinonen"}, {"lang": "en", "time": "2026-03-10T16:00:00.000Z", "value": "Candidate patch shared internally by Piotr P. Karwasz"}, {"lang": "en", "time": "2026-03-24T18:41:00.000Z", "value": "Fix shared publicly by Piotr P. Karwasz as pull request #4074"}, {"lang": "en", "time": "2026-03-25T11:02:00.000Z", "value": "Fix verified by reporter"}, {"lang": "en", "time": "2026-03-28T11:19:00.000Z", "value": "Log4j 2.25.4 released"}], "title": "Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/10/7"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-10T16:18:17.528Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T17:48:27.852992Z", "id": "CVE-2026-34478", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T17:50:12.484Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/10/7"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-10T16:18:17.528Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34478", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T17:48:27.852992Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T17:50:01.256Z"}}], "cna": {"title": "Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Samuli Leinonen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*"], "vendor": "Apache Software Foundation", "product": "Apache Log4j Core", "versions": [{"status": "affected", "version": "2.21.0", "lessThan": "2.25.4", "versionType": "maven"}, {"status": "affected", "version": "3.0.0-beta1", "versionType": "maven", "lessThanOrEqual": "3.0.0-beta3"}], "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-core", "packageName": "org.apache.logging.log4j:log4j-core", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-25T12:58:00.000Z", "value": "Vulnerability reported by Samuli Leinonen"}, {"lang": "en", "time": "2026-03-10T16:00:00.000Z", "value": "Candidate patch shared internally by Piotr P. Karwasz"}, {"lang": "en", "time": "2026-03-24T18:41:00.000Z", "value": "Fix shared publicly by Piotr P. Karwasz as pull request #4074"}, {"lang": "en", "time": "2026-03-25T11:02:00.000Z", "value": "Fix verified by reporter"}, {"lang": "en", "time": "2026-03-28T11:19:00.000Z", "value": "Log4j 2.25.4 released"}], "references": [{"url": "https://github.com/apache/logging-log4j2/pull/4074", "tags": ["patch"]}, {"url": "https://logging.apache.org/security.html#CVE-2026-34478", "tags": ["vendor-advisory"]}, {"url": "https://logging.apache.org/cyclonedx/vdr.xml", "tags": ["vendor-advisory"]}, {"url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout", "tags": ["related"]}, {"url": "https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.\n\nTwo distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:\n\n * The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.\n * The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.\n\n\nUsers of the SyslogAppender are not affected, as its configuration attributes were not modified.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Apache Log4j Core's <code><a target=\"_blank\" rel=\"nofollow\" href=\"https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout\">Rfc5424Layout</a></code>, in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.</p><p>Two distinct issues affect users of stream-based syslog services who configure <code>Rfc5424Layout</code> directly:</p><ul><li>The <code>newLineEscape</code> attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.</li><li>The <code>useTlsMessageFormat</code> attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.</li></ul><p>Users of the <code>SyslogAppender</code> are not affected, as its configuration attributes were not modified.</p><p>Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-684", "description": "CWE-684 Incorrect Provision of Specified Functionality"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-117", "description": "CWE-117 Improper Output Neutralization for Logs"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-10T15:40:17.713Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34478", "state": "PUBLISHED", "dateUpdated": "2026-04-10T17:50:12.484Z", "dateReserved": "2026-03-28T13:17:35.586Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-04-10T15:40:17.713Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "cpes": ["cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "org.apache.logging.log4j:log4j-core", "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-core", "product": "Apache Log4j Core", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.25.4", "status": "affected", "version": "2.21.0", "versionType": "maven"}, {"lessThanOrEqual": "3.0.0-beta3", "status": "affected", "version": "3.0.0-beta1", "versionType": "maven"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", "matchCriteriaId": "4928759D-3A0D-4BC2-85BC-2CFAF137B4A0", "versionEndExcluding": "2.25.4", "versionStartIncluding": "2.21.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "ED00C38D-27EA-489C-9A2B-3594ACA8A3C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "8794D719-1D90-4378-B48B-698EA40FBFB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "74C9FCBD-ECAD-4C29-B97A-2B9D97C0FC1F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.\n\nTwo distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:\n\n * The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.\n * The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.\n\n\nUsers of the SyslogAppender are not affected, as its configuration attributes were not modified.\n\nUsers are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue."}, {"lang": "es", "value": "El Rfc5424Layout de Apache Log4j Core https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , en las versiones 2.21.0 a 2.25.3, es vulnerable a la inyecci\u00f3n de registros a trav\u00e9s de secuencias CRLF debido a cambios de nombre no documentados de atributos de configuraci\u00f3n relevantes para la seguridad.\n\nDos problemas distintos afectan a los usuarios de servicios syslog basados en flujo que configuran Rfc5424Layout directamente:\n\n * El atributo newLineEscape fue renombrado silenciosamente, lo que provoc\u00f3 que el escape de nueva l\u00ednea dejara de funcionar para los usuarios de tramas TCP (RFC 6587), exponi\u00e9ndolos a la inyecci\u00f3n de CRLF en la salida de registros.\n * El atributo useTlsMessageFormat fue renombrado silenciosamente, lo que provoc\u00f3 que los usuarios de tramas TLS (RFC 5425) fueran degradados silenciosamente a TCP sin tramas (RFC 6587), sin escape de nueva l\u00ednea.\n\nLos usuarios del SyslogAppender no se ven afectados, ya que sus atributos de configuraci\u00f3n no fueron modificados.\n\nSe aconseja a los usuarios actualizar a Apache Log4j Core 2.25.4, que corrige este problema."}], "id": "CVE-2026-34478", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34478", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-10T17:48:27.852992Z", "version": "2.0.3"}}]}, "published": "2026-04-10T16:16:31.070", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/apache/logging-log4j2/pull/4074"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt"}, {"source": "security@apache.org", "tags": ["Product"], "url": "https://logging.apache.org/cyclonedx/vdr.xml"}, {"source": "security@apache.org", "tags": ["Technical Description"], "url": "https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout"}, {"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://logging.apache.org/security.html#CVE-2026-34478"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/10/7"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-117"}, {"lang": "en", "value": "CWE-684"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames", "id": "2457323", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457323"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-93", "details": ["A flaw was found in Apache Log4j Core. This vulnerability allows for log injection through the use of Carriage Return Line Feed (CRLF) sequences. This occurs because security-related configuration attributes were silently renamed, impacting users who directly configure Rfc5424Layout with stream-based syslog services. An attacker could exploit this to inject malicious data into log files, potentially obscuring critical security events or manipulating system records."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-34478", "package_state": [{"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/rhaiis-cuda-ubi9-3-2-2", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:ai_inference_server:3", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/rhaiis-cuda-ubi9-3-3", "product_name": "Red Hat AI Inference Server"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:service_registry:2", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "Red Hat build of Apicurio Registry 2"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:optaplanner:::el6", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "Red Hat build of OptaPlanner 8"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Fix deferred", "package_name": "log4j-core-test", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "log4j:2/log4j", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "pki-core:10.6/resteasy", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "pki-deps:10.6/resteasy", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "log4j", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "resteasy", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "bazel7", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "bazel8", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/bootc-cuda-3-3", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/bootc-cuda-aws-3-3", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/bootc-cuda-azure-3-3", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/bootc-cuda-gcp-3-3", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "log4j-core-test", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "log4j-core-test", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "Red Hat JBoss Web Server 6"}, {"cpe": "cpe:/a:redhat:offline_knowledge_portal:1", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/rhokp-core-encrypted", "product_name": "Red Hat Offline Knowledge Portal"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-modelmesh-rhel8", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-modelmesh-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-vllm-cuda-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-vllm-gaudi-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Fix deferred", "package_name": "log4j-core", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-04-10T15:40:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-34478\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34478\nhttps://github.com/apache/logging-log4j2/pull/4074\nhttps://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt\nhttps://logging.apache.org/cyclonedx/vdr.xml\nhttps://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout\nhttps://logging.apache.org/security.html#CVE-2026-34478"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.21.0,2.25.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0-beta1,3.0.0-beta3]"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 83.0, "source": "matching"}]}, "original": {"product": "Apache Log4j Core", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "log4j", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-14T01:41:16.274133+00:00", "value": {"mitigation_remediation": ["Verify the Log4j Core version in use. Upgrade to version 2.25.4 or later, which restores the correct configuration behavior. Confirm that Rfc5424Layout is configured correctly after the upgrade. Monitor log files for any unusual CRLF injection patterns during the transition."], "summary": {"action": "Immediate Patch", "impact": "Log injection via CRLF sequences that bypasses newline escaping, allowing malicious log forging"}, "threat_synthesis": {"affected_systems": "The vulnerability impacts all users of Apache Log4j Core versions 2.21.0 through 2.25.3 that configure Rfc5424Layout directly. SyslogAppender users are not affected because their configuration attributes remain unchanged. The affected vendor is the Apache Software Foundation and the product is Apache Log4j Core.", "description_and_impact": "Apache Log4j Core's Rfc5424Layout formats syslog messages according to RFC5424. The flaw is caused by undocumented silent renaming of two configuration attributes\u2014newLineEscape and useTlsMessageFormat. When these attributes are altered, newline escaping fails for TCP framing and TLS framing connections are silently downgraded to unframed TCP. As a result, an attacker can inject CRLF sequences into the log output, forging log lines or manipulating log parsing. This is a log injection vulnerability that undermines the integrity of log data and could facilitate later attacks such as credential theft or concealment of malicious activity.", "risk_and_exploitability": "The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, attackers can potentially exploit it remotely by sending crafted messages to a system that logs through Rfc5424Layout, achieving log forging or manipulation. Organizations should treat the risk as moderate and apply fixes promptly."}}}}, "created": "2026-04-13T12:44:44.051200+00:00", "updated": "2026-04-14T16:36:26.868360+00:00", "vendors": ["apache", "apache$PRODUCT$log4j"]}