Bug 2457328 (CVE-2026-34480)

Summary: CVE-2026-34480 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abrianik, alinfoot, aprice, asoldano, ataylor, bbaranow, bbrownin, bmaxwell, bstansbe, caswilli, chfoley, csutherl, dbruscin, dlofthou, drosa, dsoumis, dtrifiro, ewittman, fmariani, ggrzybek, gmalinko, istudens, ivassile, iweiss, janstey, jclere, jkoehler, jraez, jsamir, jwon, kaycoth, kgaikwad, kvanderr, lphiri, mcarlett, mnovotny, mosmerov, mstipich, msvehla, nipatil, nwallace, oezr, pantinor, parichar, pberan, pbizzarr, pdelbell, pesilva, pjindal, plodge, pmackay, rbryant, rexwhite, rgodfrey, rhel-process-autobot, rkubis, rmaucher, rstancel, rstepani, sausingh, smaestri, sthirugn, swoodman, szappis, tasato, tcunning, thjenkin, vdosoudi, watson-tool-maintainers, weaton, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Apache Log4j Core. The XmlLayout component, responsible for formatting log messages into XML, does not properly remove or replace characters that are not allowed in XML 1.0. When log messages or diagnostic information contain these forbidden characters, the resulting XML output becomes invalid. This can lead to two main issues: either systems processing these logs will fail to read the affected records, or the logging process itself will stop delivering events, both resulting in a denial of service for logging operations.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2457886, 2457889, 2457890, 2457885, 2457887, 2457888    
Bug Blocks:    

Description OSIDB Bzimport 2026-04-10 16:02:41 UTC 
Apache Log4j Core's  XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  producing invalid XML output whenever a log message or MDC value contains such characters.

The impact depends on the StAX implementation in use:

  *  JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
  *  Alternative StAX implementations (e.g.,  Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.


Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
Comment 2 errata-xmlrpc 2026-06-02 17:41:24 UTC 
This issue has been addressed in the following products:

  Red Hat Data Grid 8.6.1

Via RHSA-2026:22619 https://access.redhat.com/errata/RHSA-2026:22619
Comment 3 errata-xmlrpc 2026-07-02 00:03:56 UTC 
This issue has been addressed in the following products:

  Streams for Apache Kafka 2.9.4

Via RHSA-2026:34608 https://access.redhat.com/errata/RHSA-2026:34608
Comment 4 errata-xmlrpc 2026-07-09 15:29:24 UTC 
This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16

Via RHSA-2026:37390 https://access.redhat.com/errata/RHSA-2026:37390