CVE-2026-34478

Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility

Published Apr 10, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes.

Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:

* The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output.
* The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.

Users of the SyslogAppender are not affected, as its configuration attributes were not modified.

Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

Analysis

Technical impact

Apache Log4j Core's Rfc5424Layout formats syslog messages according to RFC5424. The flaw is caused by undocumented silent renaming of two configuration attributes—newLineEscape and useTlsMessageFormat. When these attributes are altered, newline escaping fails for TCP framing and TLS framing connections are silently downgraded to unframed TCP. As a result, an attacker can inject CRLF sequences into the log output, forging log lines or manipulating log parsing. This is a log injection vulnerability that undermines the integrity of log data and could facilitate later attacks such as credential theft or concealment of malicious activity.

Affected Systems

The vulnerability impacts all users of Apache Log4j Core versions 2.21.0 through 2.25.3 that configure Rfc5424Layout directly. SyslogAppender users are not affected because their configuration attributes remain unchanged. The affected vendor is the Apache Software Foundation and the product is Apache Log4j Core.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, attackers can potentially exploit it remotely by sending crafted messages to a system that logs through Rfc5424Layout, achieving log forging or manipulation. Organizations should treat the risk as moderate and apply fixes promptly.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache Log4j Core

unaffected

Version	Status	Constraints
`2.21.0`	affected	< 2.25.4
`3.0.0-beta1`	affected	≤ 3.0.0-beta3

Configuration 1 [-]

OR	cpe:2.3:a:apache:log4j::::::::
	cpe:2.3:a:apache:log4j:3.0.0:beta1::::::
	cpe:2.3:a:apache:log4j:3.0.0:beta2::::::
	cpe:2.3:a:apache:log4j:3.0.0:beta3::::::

No data.

Vendor Product Versions

Apache

Log4j

Version	Status	Scheme	Platform
`[2.21.0,2.25.4)`	affected	semver	—
`[3.0.0-beta1,3.0.0-beta3]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Verify the Log4j Core version in use. Upgrade to version 2.25.4 or later, which restores the correct configuration behavior. Confirm that Rfc5424Layout is configured correctly after the upgrade. Monitor log files for any unusual CRLF injection patterns during the transition.

Generated by OpenCVE AI on April 14, 2026 at 01:41 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-445c-vh5m-36rj	Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.989% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/04/10/7
https://github.com/apache/logging-log4j2/pull/4074
https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt
https://logging.apache.org/cyclonedx/vdr.xml
https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout
https://logging.apache.org/security.html#CVE-2026-34478
https://nvd.nist.gov/vuln/detail/CVE-2026-34478
https://www.cve.org/CVERecord?id=CVE-2026-34478

History

Apr 24, 2026 6:15 PM Affected versions updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:apache:log4j:3.0.0:beta1:::::: cpe:2.3:a:apache:log4j:3.0.0:beta2:::::: cpe:2.3:a:apache:log4j:3.0.0:beta3::::::
Metrics	cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}`

Apr 14, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-93
References		https://nvd.nist.gov/vuln/detail/CVE-2026-34478 https://www.cve.org/CVERecord?id=CVE-2026-34478
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N'}` threat_severity `Moderate`

Apr 10, 2026 6:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 10, 2026 5:30 PM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/04/10/7

Apr 10, 2026 4:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly: * The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output. * The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping. Users of the SyslogAppender are not affected, as its configuration attributes were not modified. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
Title		Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility
First Time appeared		Apache Apache log4j
Weaknesses		CWE-117 CWE-684
CPEs		cpe:2.3:a:apache:log4j::::::::
Vendors & Products		Apache Apache log4j
References		https://github.com/apache/logging-log4j2/pull/4074 https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt https://logging.apache.org/cyclonedx/vdr.xml https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout https://logging.apache.org/security.html#CVE-2026-34478
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N'}`