CLEANSTART-2026-EJ90650 Included in Log4j 1

Security vulnerability affects the apache-hive package. Included in Log4j 1...

CLEANSTART-2026-CB62266 By design, the JDBCAppender in Log4j 1

Security vulnerability affects the apache-hive package. By design, the JDBCAppender in Log4j 1...

CLEANSTART-2026-FS95827 JMSAppender in Log4j 1

Security vulnerability affects the apache-hive package. JMSAppender in Log4j 1...

log4shell_1.x

Log4jShell1.x Log4j RCE 1.x Poc Attack Restriction 1. The target has jms environment 2. You need to gain access to modify the log4j.properties file Conclusion Not as useful as log4shell 2.x Log4shell Topic https://github.com/cckuailong/reapoc/tree/main/Topic/Log4j Welcome to contribute in reapoc...

CLEANSTART-2026-LD36349 Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1

Security vulnerability affects the sonarqube package. The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1...

log4j-CVE-2021-4104

250005e035c957e6d8b6faf6f55b45a665a14263...

Astra Linux – Vulnerability in Apache Log4j1.2

The JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration, or when the configuration references an LDAP service to which the attacker has access. The attacker can provide a...

AlmaLinux 9.2 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.2:CLSA-2026:1780054786)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780054786 advisory. - The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing...

Rocky Linux 9.6 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.6:CLSA-2026:1779124827)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779124827 advisory. - The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing...

AlmaLinux 9.6 [TuxCare] Security Update: log4j / log4j-jcl / log4j-slf4j / log4j-web (ALMALINUX9.6:CLSA-2026:1779124827)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779124827 advisory. - The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing...

Security Bulletin: Due to use of log4j-core, IBM webMethods BPM is vulnerable to Improper Encoding or Escaping of Output

Summary IBM webMethods BPM is dependant on log4j-core which is affected by known vulnerability - CVE-2026-34479 Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: log4j12 (UTSA-2026-093024)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093024 advisory. By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. T...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: log4j12 (UTSA-2026-093022)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093022 advisory. JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the...

CVE-2026-34479: Improper Encoding or Escaping of Output

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log...

Amazon Linux AMI : log4j (ALAS-2023-1718)

The version of log4j installed on the remote host is prior to 1.2.17-16.14. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1718 advisory. A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSSink in Log4j 1.x is vulnerable to...

Code injection

UNSUPPORTED WHEN ASSIGNED When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted ie, deeply nested hashmap or hashtable depending on which logging component is in use to be processed...

CVE-2023-26464

UNSUPPORTED WHEN ASSIGNED When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted ie, deeply nested hashmap or hashtable depending on which logging component is in use to be processed...

CVE-2023-26464

The CVE-2023-26464 issue affects Apache Log4j 1.x Chainsaw and SocketAppender when running on JRE

CVE-2023-26464

UNSUPPORTED WHEN ASSIGNED When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted ie, deeply nested hashmap or hashtable depending on which logging component is in use to be processed...

CVE-2023-26464 Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

UNSUPPORTED WHEN ASSIGNED When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted ie, deeply nested hashmap or hashtable depending on which logging component is in use to be processed...