CVE-2026-40023 Apache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden characters

Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx11xml11XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/charsets in log messages, NDC, and MDC property keys and values, producin...

Apache log4net 安全漏洞

Apache Log4net is a logging output tool developed by the Apache Foundation in the United States. Versions of Apache Log4net prior to 3.3.0 contained security vulnerabilities. These vulnerabilities stemmed from the fact that XmlLayout and XmlLayoutSchemaLog4J did not remove characters prohibited b...