Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4
purl pkg:maven/org.apache.logging.log4j/log4j-core@2.25.4
This package is not known to be subject of any advisories.
Vulnerabilities fixed by this package (5)

Advisory Summary Aliases
GHSA-6hg6-v5c8-fphq
Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration The fix for CVE-2025-68161 was incomplete: it addressed hostname verification … CVE-2026-34477
GHSA-3pxv-7cmr-fjr4
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters Apache Log4j Core's [`XmlLayout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout), … CVE-2026-34480
GHSA-445c-vh5m-36rj
Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility Apache Log4j Core's [`Rfc5424Layout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout), in versions 2.21.0 through … CVE-2026-34478
GHSA-h383-gmxw-35v2
Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters … CVE-2026-34479
CVE-2026-34479
Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters … GHSA-h383-gmxw-35v2