Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.apache.logging.log4j/log4j-core@2.21.0
Typemaven
Namespaceorg.apache.logging.log4j
Namelog4j-core
Version2.21.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version2.25.4
Latest_non_vulnerable_version2.25.4
Affected_by_vulnerabilities
0
url VCID-b575-sfrs-bfdw
vulnerability_id VCID-b575-sfrs-bfdw
summary Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly: * The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output. * The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping. Users of the SyslogAppender are not affected, as its configuration attributes were not modified. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34478.json
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34478.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-34478
reference_id
reference_type
scores
0
value 0.00034
scoring_system epss
scoring_elements 0.10474
published_at 2026-06-08T12:55:00Z
1
value 0.00034
scoring_system epss
scoring_elements 0.10576
published_at 2026-06-05T12:55:00Z
2
value 0.00034
scoring_system epss
scoring_elements 0.10599
published_at 2026-06-06T12:55:00Z
3
value 0.00034
scoring_system epss
scoring_elements 0.1056
published_at 2026-06-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-34478
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/logging-log4j2
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/logging-log4j2
4
reference_url https://github.com/apache/logging-log4j2/pull/4074
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:48:27Z/
url https://github.com/apache/logging-log4j2/pull/4074
5
reference_url https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:48:27Z/
url https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt
6
reference_url https://logging.apache.org/cyclonedx/vdr.xml
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:48:27Z/
url https://logging.apache.org/cyclonedx/vdr.xml
7
reference_url https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:48:27Z/
url https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout
8
reference_url https://logging.apache.org/security.html#CVE-2026-34478
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:48:27Z/
url https://logging.apache.org/security.html#CVE-2026-34478
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-34478
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-34478
10
reference_url http://www.openwall.com/lists/oss-security/2026/04/10/7
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/04/10/7
11
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2457323
reference_id 2457323
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2457323
12
reference_url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
reference_id cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
reference_type
scores
url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
13
reference_url https://github.com/advisories/GHSA-445c-vh5m-36rj
reference_id GHSA-445c-vh5m-36rj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-445c-vh5m-36rj
14
reference_url https://access.redhat.com/errata/RHSA-2026:21773
reference_id RHSA-2026:21773
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:21773
15
reference_url https://access.redhat.com/errata/RHSA-2026:22619
reference_id RHSA-2026:22619
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:22619
fixed_packages
0
url pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4
purl pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4
aliases CVE-2026-34478, GHSA-445c-vh5m-36rj
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-b575-sfrs-bfdw
1
url VCID-bpjn-vu9d-zyc9
vulnerability_id VCID-bpjn-vu9d-zyc9
summary 
Apache Log4j does not verify the TLS hostname in its Socket Appender
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  [verifyHostName](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName)  configuration attribute or the  [log4j2.sslVerifyHostName](https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName) system property is set to true.

This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:

*  The attacker is able to intercept or redirect network traffic between the client and the log receiver.
*  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).


Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.

As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68161.json
reference_id
reference_type
scores
0
value 5.9
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-68161.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-68161
reference_id
reference_type
scores
0
value 0.00029
scoring_system epss
scoring_elements 0.08863
published_at 2026-06-08T12:55:00Z
1
value 0.00029
scoring_system epss
scoring_elements 0.08912
published_at 2026-06-05T12:55:00Z
2
value 0.00029
scoring_system epss
scoring_elements 0.08928
published_at 2026-06-06T12:55:00Z
3
value 0.00029
scoring_system epss
scoring_elements 0.08909
published_at 2026-06-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-68161
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68161
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68161
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/apache/logging-log4j2
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/logging-log4j2
5
reference_url https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578
6
reference_url https://github.com/apache/logging-log4j2/pull/4002
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-18T21:34:24Z/
url https://github.com/apache/logging-log4j2/pull/4002
7
reference_url https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-18T21:34:24Z/
url https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx
8
reference_url https://logging.apache.org/cyclonedx/vdr.xml
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-18T21:34:24Z/
url https://logging.apache.org/cyclonedx/vdr.xml
9
reference_url https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-18T21:34:24Z/
url https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName
10
reference_url https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-18T21:34:24Z/
url https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName
11
reference_url https://logging.apache.org/security.html#CVE-2025-68161
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-12-18T21:34:24Z/
url https://logging.apache.org/security.html#CVE-2025-68161
12
reference_url http://www.openwall.com/lists/oss-security/2025/12/18/1
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2025/12/18/1
13
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123744
reference_id 1123744
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123744
14
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2423705
reference_id 2423705
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2423705
15
reference_url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
reference_id cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
reference_type
scores
url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
16
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-68161
reference_id CVE-2025-68161
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-68161
17
reference_url https://github.com/advisories/GHSA-vc5p-v9hr-52mj
reference_id GHSA-vc5p-v9hr-52mj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vc5p-v9hr-52mj
fixed_packages
0
url pkg:maven/org.apache.logging.log4j/log4j-core@2.25.3
purl pkg:maven/org.apache.logging.log4j/log4j-core@2.25.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-b575-sfrs-bfdw
1
vulnerability VCID-k88w-sf7h-dken
2
vulnerability VCID-p2pt-hvun-aybq
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.logging.log4j/log4j-core@2.25.3
aliases CVE-2025-68161, GHSA-vc5p-v9hr-52mj
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bpjn-vu9d-zyc9
2
url VCID-k88w-sf7h-dken
vulnerability_id VCID-k88w-sf7h-dken
summary The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the <Ssl> element. Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value. A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met: * An SMTP, Socket, or Syslog appender is in use. * TLS is configured via a nested <Ssl> element. * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34477.json
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34477.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-34477
reference_id
reference_type
scores
0
value 0.00029
scoring_system epss
scoring_elements 0.08585
published_at 2026-06-08T12:55:00Z
1
value 0.00029
scoring_system epss
scoring_elements 0.08636
published_at 2026-06-05T12:55:00Z
2
value 0.00029
scoring_system epss
scoring_elements 0.08652
published_at 2026-06-06T12:55:00Z
3
value 0.00029
scoring_system epss
scoring_elements 0.08632
published_at 2026-06-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-34477
2
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
3
reference_url https://github.com/apache/logging-log4j2
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/logging-log4j2
4
reference_url https://github.com/apache/logging-log4j2/pull/4075
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:36:46Z/
url https://github.com/apache/logging-log4j2/pull/4075
5
reference_url https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:36:46Z/
url https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4
6
reference_url https://logging.apache.org/cyclonedx/vdr.xml
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:36:46Z/
url https://logging.apache.org/cyclonedx/vdr.xml
7
reference_url https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:36:46Z/
url https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName
8
reference_url https://logging.apache.org/security.html#CVE-2026-34477
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:36:46Z/
url https://logging.apache.org/security.html#CVE-2026-34477
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-34477
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-34477
10
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2457319
reference_id 2457319
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2457319
11
reference_url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
reference_id cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
reference_type
scores
url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
12
reference_url https://github.com/advisories/GHSA-6hg6-v5c8-fphq
reference_id GHSA-6hg6-v5c8-fphq
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6hg6-v5c8-fphq
13
reference_url https://access.redhat.com/errata/RHSA-2026:21773
reference_id RHSA-2026:21773
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:21773
fixed_packages
0
url pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4
purl pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4
aliases CVE-2026-34477, GHSA-6hg6-v5c8-fphq
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-k88w-sf7h-dken
3
url VCID-p2pt-hvun-aybq
vulnerability_id VCID-p2pt-hvun-aybq
summary Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use: * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records. * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34480.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-34480.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-34480
reference_id
reference_type
scores
0
value 0.00034
scoring_system epss
scoring_elements 0.10417
published_at 2026-06-08T12:55:00Z
1
value 0.00034
scoring_system epss
scoring_elements 0.10521
published_at 2026-06-05T12:55:00Z
2
value 0.00034
scoring_system epss
scoring_elements 0.10541
published_at 2026-06-06T12:55:00Z
3
value 0.00034
scoring_system epss
scoring_elements 0.10503
published_at 2026-06-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-34480
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34480
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34480
3
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
4
reference_url https://github.com/apache/logging-log4j2
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/apache/logging-log4j2
5
reference_url https://github.com/apache/logging-log4j2/pull/4077
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:43:51Z/
url https://github.com/apache/logging-log4j2/pull/4077
6
reference_url https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:43:51Z/
url https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb
7
reference_url https://logging.apache.org/cyclonedx/vdr.xml
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:43:51Z/
url https://logging.apache.org/cyclonedx/vdr.xml
8
reference_url https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:43:51Z/
url https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout
9
reference_url https://logging.apache.org/security.html#CVE-2026-34480
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-10T17:43:51Z/
url https://logging.apache.org/security.html#CVE-2026-34480
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-34480
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-34480
11
reference_url http://www.openwall.com/lists/oss-security/2026/04/10/9
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.openwall.com/lists/oss-security/2026/04/10/9
12
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133847
reference_id 1133847
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133847
13
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136032
reference_id 1136032
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136032
14
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2457328
reference_id 2457328
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2457328
15
reference_url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
reference_id cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
reference_type
scores
url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
16
reference_url https://github.com/advisories/GHSA-3pxv-7cmr-fjr4
reference_id GHSA-3pxv-7cmr-fjr4
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3pxv-7cmr-fjr4
17
reference_url https://access.redhat.com/errata/RHSA-2026:21773
reference_id RHSA-2026:21773
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:21773
18
reference_url https://access.redhat.com/errata/RHSA-2026:22619
reference_id RHSA-2026:22619
reference_type
scores
url https://access.redhat.com/errata/RHSA-2026:22619
fixed_packages
0
url pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4
purl pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4
aliases CVE-2026-34480, GHSA-3pxv-7cmr-fjr4
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-p2pt-hvun-aybq
Fixing_vulnerabilities
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.apache.logging.log4j/log4j-core@2.21.0