---
id: CVE-2026-34479
aliases:
  - GHSA-h383-gmxw-35v2
title: >-
  Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due
  to unescaped XML 1.0 forbidden characters
summary: >-
  Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due
  to unescaped XML 1.0 forbidden characters
severity: medium
cwe:
  - CWE-116
vendor: apache
product: 'org.apache.logging.log4j:log4j-core'
ecosystem: maven
affected:
  - 'org.apache.logging.log4j:log4j-core >= 2.7, < 2.25.4'
  - 'org.apache.logging.log4j:log4j-core >= 3.0.0-beta1, <= 3.0.0-beta2'
patched:
  - 'org.apache.logging.log4j:log4j-core 2.25.4'
published: '2026-04-10'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T15:16:51Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-h383-gmxw-35v2'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34479'
  - url: 'https://github.com/apache/logging-log4j2/pull/4078'
  - url: 'https://lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on'
  - url: 'https://logging.apache.org/cyclonedx/vdr.xml'
  - url: 'https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html'
  - url: 'https://logging.apache.org/security.html#CVE-2026-34479'
  - url: 'http://www.openwall.com/lists/oss-security/2026/04/10/8'
  - url: 'https://github.com/advisories/GHSA-h383-gmxw-35v2'
tags:
  - ghsa
  - maven
epss: 0.00535
epssPercentile: 0.44924
ingestedAt: '2026-10-26T15:29:30.490Z'
---

## Overview

The `Log4j1XmlLayout` from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records.

Two groups of users are affected:

* Those using `Log4j1XmlLayout` directly in a Log4j Core 2 configuration file.
* Those using the Log4j 1 configuration compatibility layer with `org.apache.log4j.xml.XMLLayout` specified as the layout class.

Users are advised to upgrade to Apache Log4j 1-to-Log4j 2 bridge version `2.25.4`, which corrects this issue.

> [!NOTE]
> The Apache Log4j 1-to-Log4j 2 bridge is deprecated and will not be present in Log4j 3. Users are encouraged to consult the
> [Log4j 1 to Log4j 2 migration guide](https://logging.apache.org/log4j/2.x/migrate-from-log4j1.html), and specifically the section on eliminating reliance on the bridge.

## Affected packages

- `org.apache.logging.log4j:log4j-core >= 2.7, < 2.25.4`
- `org.apache.logging.log4j:log4j-core >= 3.0.0-beta1, <= 3.0.0-beta2`

## Remediation

Upgrade to a patched release:

- `org.apache.logging.log4j:log4j-core 2.25.4`