CVE-2026-34479

🗓️ 10 Apr 2026 16:16:31Reported by [email protected]Type

CVE-2026-34479: Log4j1XmlLayout outputs invalid XML and may disrupt log indexing; upgrade to 2.25.4.

Reporter	Title	Published	Views	Family All 104
IBM Security Bulletins	Security Bulletin: IBM Maximo Scheduler Optimizer uses log4j-core-2.25.3.jar which is vulnerable to CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480	7 Jul 202613:50	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple log4j related security vulnerabilities in IBM Guardium Key Lifecycle Manager	13 Jul 202609:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Log4j	24 Jun 202622:08	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Apache Log4j	1 Jul 202605:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	19 Jun 202608:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® is affected by a vulnerability in log4j-core (CVE-2026-34479)	10 Jul 202618:14	–	ibm
IBM Security Bulletins	Security Bulletin: Log4j Core TLS hostname verification bypass via verifyHostName XML attribute allows man-in-the-middle attacks on SMTP/Socket/Syslog appenders.	29 Jun 202613:33	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in log4j/2.x affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues	24 Jun 202606:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Disconnected Log Collector	14 Jul 202613:12	–	ibm

NVD

Node

apache log4jRange2.7–2.25.4

apache log4jMatch3.0.0alpha1

apache log4jMatch3.0.0alpha1_rc1

apache log4jMatch3.0.0alpha1_rc2

apache log4jMatch3.0.0beta1

apache log4jMatch3.0.0beta2

Source	Link
logging	www.logging.apache.org/cyclonedx/vdr.xml
github	www.github.com/apache/logging-log4j2/pull/4078
openwall	www.openwall.com/lists/oss-security/2026/04/10/8
logging	www.logging.apache.org/security.html
lists	www.lists.apache.org/thread/gd0hp6mj17rn3kj279vgy4p7kd4zz5on
logging	www.logging.apache.org/log4j/2.x/migrate-from-log4j1.html

17 Jun 2026 10:39Current

CVSS 3.17.5

CVSS 46.9

EPSS0.00535

CWE-116