[From nobody Thu Oct 15 23:43:11 2026 Received: (at submit) by bugs.debian.org; 14 Apr 2026 20:43:42 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-11.0 required=4.0 tests=BAYES_00,FROMDEVELOPER, FVGT_m_MULTI_ODD,MD5_SHA1_SUM,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 23; hammy, 150; neutral, 119; spammy, 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian, 0.000-+--H*Ad:N*Bug Return-path: <carnil@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1wCkbl-006Q2o-1v for submit@bugs.debian.org; Tue, 14 Apr 2026 20:43:42 +0000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: apache-log4j2: CVE-2026-34480 Message-ID: <177619942058.262520.15814533541805680186.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0 Date: Tue, 14 Apr 2026 22:43:40 +0200 Delivered-To: submit@bugs.debian.org Source: apache-log4j2 Version: 2.19.0-2 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerability was published for apache-log4j2. CVE-2026-34480[0]: | Apache Log4j Core's XmlLayout | https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , | in versions up to and including 2.25.3, fails to sanitize characters | forbidden by the XML 1.0 specification | https://www.w3.org/TR/xml/#charsets producing invalid XML output | whenever a log message or MDC value contains such characters. The | impact depends on the StAX implementation in use: * JRE built-in | StAX: Forbidden characters are silently written to the output, | producing malformed XML. Conforming parsers must reject such | documents with a fatal error, which may cause downstream log- | processing systems to drop the affected records. * Alternative | StAX implementations (e.g., Woodstox | https://github.com/FasterXML/woodstox , a transitive dependency of | the Jackson XML Dataformat module): An exception is thrown during | the logging call, and the log event is never delivered to its | intended appender, only to Log4j's internal status logger. Users | are advised to upgrade to Apache Log4j Core 2.25.4, which corrects | this issue by sanitizing forbidden characters before XML output. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-34480 https://www.cve.org/CVERecord?id=CVE-2026-34480 [1] https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb [2] https://logging.apache.org/security.html#CVE-2026-34480 [3] https://github.com/apache/logging-log4j2/pull/4077 [4] https://github.com/apache/logging-log4j2/commit/4f5014229825d8be977662e0743205bb8a67f989 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]