CVE-2025-54813

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-54813", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2025-07-30T01:20:34.786Z", "datePublished": "2025-08-22T18:45:42.611Z", "dateUpdated": "2025-11-04T21:12:54.283Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Log4cxx", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.5.0", "status": "affected", "version": "0.11.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "sponsor", "value": "Sovereign Tech Agency"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.</p><p>When using <code>JSONLayout</code>, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.</p><p>This issue affects Apache Log4cxx: before <code>1.5.0</code>.</p><p>Users are recommended to upgrade to version <code>1.5.0</code>, which fixes the issue.</p>"}], "value": "Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.\n\nWhen using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.\n\nThis issue affects Apache Log4cxx: before 1.5.0.\n\nUsers are recommended to upgrade to version 1.5.0, which fixes the issue."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-117", "description": "CWE-117 Improper Output Neutralization for Logs", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-08-22T18:45:42.611Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://logging.apache.org/security.html#CVE-2025-54813"}, {"tags": ["patch"], "url": "https://github.com/apache/logging-log4cxx/pull/512"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Log4cxx: Improper escaping with JSONLayout", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-22T19:05:35.967614Z", "id": "CVE-2025-54813", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-22T19:05:49.161Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00002.html"}, {"url": "http://www.openwall.com/lists/oss-security/2025/08/22/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:12:54.283Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00002.html"}, {"url": "http://www.openwall.com/lists/oss-security/2025/08/22/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:12:54.283Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-54813", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-22T19:05:35.967614Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-22T19:05:43.288Z"}}], "cna": {"title": "Apache Log4cxx: Improper escaping with JSONLayout", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "sponsor", "value": "Sovereign Tech Agency"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Log4cxx", "versions": [{"status": "affected", "version": "0.11.0", "lessThan": "1.5.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://logging.apache.org/security.html#CVE-2025-54813", "tags": ["vendor-advisory"]}, {"url": "https://github.com/apache/logging-log4cxx/pull/512", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.\n\nWhen using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.\n\nThis issue affects Apache Log4cxx: before 1.5.0.\n\nUsers are recommended to upgrade to version 1.5.0, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.</p><p>When using <code>JSONLayout</code>, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.</p><p>This issue affects Apache Log4cxx: before <code>1.5.0</code>.</p><p>Users are recommended to upgrade to version <code>1.5.0</code>, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-117", "description": "CWE-117 Improper Output Neutralization for Logs"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2025-08-22T18:45:42.611Z"}}}, "cveMetadata": {"cveId": "CVE-2025-54813", "state": "PUBLISHED", "dateUpdated": "2025-11-04T21:12:54.283Z", "dateReserved": "2025-07-30T01:20:34.786Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2025-08-22T18:45:42.611Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Log4cxx", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "1.5.0", "status": "affected", "version": "0.11.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:log4cxx:*:*:*:*:*:*:*:*", "matchCriteriaId": "8E1443DD-B968-4005-A287-964C6197FEB0", "versionEndExcluding": "1.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.\n\nWhen using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.\n\nThis issue affects Apache Log4cxx: before 1.5.0.\n\nUsers are recommended to upgrade to version 1.5.0, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de neutralizaci\u00f3n de salida incorrecta para registros en Apache Log4cxx. Al usar JSONLayout, no todos los bytes del payload se escapan correctamente. Si un mensaje proporcionado por un atacante contiene caracteres no imprimibles, estos se pasar\u00e1n en el mensaje y se escribir\u00e1n como parte del mensaje JSON. Esto puede impedir que las aplicaciones que consumen estos registros interpreten correctamente la informaci\u00f3n que contienen. Este problema afecta a Apache Log4cxx: versiones anteriores a la 1.5.0. Se recomienda actualizar a la versi\u00f3n 1.5.0, que soluciona el problema."}], "id": "CVE-2025-54813", "lastModified": "2026-06-17T09:40:45.287", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54813", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-22T19:05:35.967614Z", "version": "2.0.3"}}]}, "published": "2025-08-22T19:15:40.003", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/apache/logging-log4cxx/pull/512"}, {"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://logging.apache.org/security.html#CVE-2025-54813"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/08/22/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00002.html"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-117"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "apache-log4cxx: Log4cxx: Improper JSON Output Neutralization", "id": "2390431", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2390431"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-117", "details": ["Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.\nWhen using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.\nThis issue affects Apache Log4cxx: before 1.5.0.\nUsers are recommended to upgrade to version 1.5.0, which fixes the issue."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-54813", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "log4cxx", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2025-08-22T18:45:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-54813\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-54813\nhttps://github.com/apache/logging-log4cxx/pull/512\nhttps://logging.apache.org/security.html#CVE-2025-54813"], "threat_severity": "Moderate"}

{"created": "2025-08-23T10:54:59.088167+00:00", "updated": "2025-08-23T10:54:59.088217+00:00", "vendors": ["apache", "apache$PRODUCT$log4cxx"]}