Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.logging.log4j/log4j-core@3.0.0-alpha1
purl pkg:maven/org.apache.logging.log4j/log4j-core@3.0.0-alpha1
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 3.1
Vulnerabilities affecting this package (2)
Advisory Summary Fixed in package version
GHSA-6hg6-v5c8-fphq
Aliases:
CVE-2026-34477
Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration The fix for CVE-2025-68161 was incomplete: it addressed hostname verification … There are no reported fixed by versions.
GHSA-3pxv-7cmr-fjr4
Aliases:
CVE-2026-34480
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters Apache Log4j Core's [`XmlLayout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout), … There are no reported fixed by versions.
This package is not known to fix any advisories.