CVE-2026-34478: apache log4j

csirt@kutim:~/threat-intel/cve/CVE-2026-34478

CVSS 7.5 · High EPSS 1,2%

Kerentanan Improper Output Neutralization for Logs pada apache log4j. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly: * The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output. * The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping. Users of the SyslogAppender are not affected, as its configuration attributes were not modified. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

Rincian

Terbit di NVD: 10 April 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-117: Improper Output Neutralization for Logs
CWE-684: Incorrect Provision of Specified Functionality
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 67,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	log4j	Versi 2.21.0 hingga sebelum 2.25.4
apache	log4j	Versi 3.0.0 beta1
apache	log4j	Versi 3.0.0 beta2
apache	log4j	Versi 3.0.0 beta3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt mailing list · advisory vendor
https://logging.apache.org/security.html#CVE-2026-34478 advisory vendor
https://github.com/apache/logging-log4j2/pull/4074 issue tracking · patch
http://www.openwall.com/lists/oss-security/2026/04/10/7 mailing list · advisory pihak ketiga
https://logging.apache.org/cyclonedx/vdr.xml product
https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout deskripsi teknis

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.