Apache Log4j Core's Rfc5424Layout formats syslog messages according to RFC5424. The flaw is caused by undocumented silent renaming of two configuration attributes—newLineEscape and useTlsMessageFormat. When these attributes are altered, newline escaping fails for TCP framing and TLS framing connections are silently downgraded to unframed TCP. As a result, an attacker can inject CRLF sequences into the log output, forging log lines or manipulating log parsing. This is a log injection vulnerability that undermines the integrity of log data and could facilitate later attacks such as credential theft or concealment of malicious activity.

The vulnerability impacts all users of Apache Log4j Core versions 2.21.0 through 2.25.3 that configure Rfc5424Layout directly. SyslogAppender users are not affected because their configuration attributes remain unchanged. The affected vendor is the Apache Software Foundation and the product is Apache Log4j Core.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, attackers can potentially exploit it remotely by sending crafted messages to a system that logs through Rfc5424Layout, achieving log forging or manipulation. Organizations should treat the risk as moderate and apply fixes promptly.