Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Apache Log4j

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Apache Log4j. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape...

ch.qos.logback:log4j-bridge (0.9.3), ch.qos.logback:logback-access (0.9.3) +2 more potentially affected by CVE-2026-10532 via ch.qos.logback:logback-core (0.9.3)

ch.qos.logback:logback-core MAVEN version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.9.3 - ch.qos.logback:logback-access 0.9.3 - ch.qos.logback:logback-classic...

ch.qos.logback:log4j-bridge (0.9.2), ch.qos.logback:logback-access (0.9.2) +2 more potentially affected by CVE-2026-9828 via ch.qos.logback:logback-core (0.9.2)

ch.qos.logback:logback-core MAVEN version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.9.2 - ch.qos.logback:logback-access 0.9.2 - ch.qos.logback:logback-classic...

SUSE CVE-2026-34479

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log...

CVE-2026-34479

A flaw was found in the Apache Log4j 1-to-Log4j 2 bridge. The Log4j1XmlLayout component fails to properly escape characters forbidden by the XML 1.0 standard. This improper handling of characters results in malformed XML output, which can cause downstream log processing systems to drop or fail to...

EUVD-2026-21409

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log...

GHSA-H383-GMXW-35V2 Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log...

CVE-2026-34479

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log...

PT-2026-31941

Name of the Vulnerable Software and Affected Versions Apache Log4j 1-to-Log4j 2 bridge versions prior to 2.25.4 Description The Log4j1XmlLayout component fails to escape characters forbidden by the XML 1.0 standard, resulting in malformed XML output. Because conforming XML parsers must reject...

ch.qos.logback:log4j-bridge (0.9.7), ch.qos.logback:logback-access (0.9.7) +3 more potentially affected by CVE-2026-1225 via ch.qos.logback:logback-core (0.9.7)

ch.qos.logback:logback-core MAVEN version 0.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.9.7 - ch.qos.logback:logback-access 0.9.7 - ch.qos.logback:logback-classic...

ch.qos.logback:log4j-bridge (0.7.1), ch.qos.logback:logback-access (0.7.1) +2 more potentially affected by CVE-2026-1225 via ch.qos.logback:logback-core (0.7.1)

ch.qos.logback:logback-core MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.7.1 - ch.qos.logback:logback-access 0.7.1 - ch.qos.logback:logback-classic...

ch.qos.logback:log4j-bridge (0.8.1), ch.qos.logback:logback-access (0.8.1) +2 more potentially affected by CVE-2025-11226 via ch.qos.logback:logback-core (0.8.1)

ch.qos.logback:logback-core MAVEN version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.8.1 - ch.qos.logback:logback-access 0.8.1 - ch.qos.logback:logback-classic...

ch.qos.logback:log4j-bridge (0.9.2), ch.qos.logback:logback-access (0.9.2) +2 more potentially affected by CVE-2025-11226 via ch.qos.logback:logback-core (0.9.2)

ch.qos.logback:logback-core MAVEN version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.9.2 - ch.qos.logback:logback-access 0.9.2 - ch.qos.logback:logback-classic...

ch.qos.logback:log4j-bridge (0.9.4), ch.qos.logback:logback-access (0.9.4) +2 more potentially affected by CVE-2025-11226 via ch.qos.logback:logback-core (0.9.4)

ch.qos.logback:logback-core MAVEN version 0.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.9.4 - ch.qos.logback:logback-access 0.9.4 - ch.qos.logback:logback-classic...

ch.qos.logback:log4j-bridge (0.9.1), ch.qos.logback:logback-access (0.9.1) +2 more potentially affected by CVE-2024-12801 via ch.qos.logback:logback-core (0.9.1)

ch.qos.logback:logback-core MAVEN version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.9.1 - ch.qos.logback:logback-access 0.9.1 - ch.qos.logback:logback-classic...

ch.qos.logback:log4j-bridge (0.9), ch.qos.logback:logback-access (0.9) +2 more potentially affected by CVE-2024-12798 via ch.qos.logback:logback-core (0.9)

ch.qos.logback:logback-core MAVEN version 0.9 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.9 - ch.qos.logback:logback-access 0.9 - ch.qos.logback:logback-classic 0.9 -...

ch.qos.logback:log4j-bridge (0.9.1), ch.qos.logback:logback-access (0.9.1) +2 more potentially affected by CVE-2024-12798 via ch.qos.logback:logback-core (0.9.1)

ch.qos.logback:logback-core MAVEN version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.9.1 - ch.qos.logback:logback-access 0.9.1 - ch.qos.logback:logback-classic...

ch.qos.logback:log4j-bridge (0.9.2), ch.qos.logback:logback-access (0.9.2) +2 more potentially affected by CVE-2024-12801 via ch.qos.logback:logback-core (0.9.2)

ch.qos.logback:logback-core MAVEN version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.9.2 - ch.qos.logback:logback-access 0.9.2 - ch.qos.logback:logback-classic...

ch.qos.logback:log4j-bridge (0.9.2), ch.qos.logback:logback-access (0.9.2) +2 more potentially affected by CVE-2024-12798 via ch.qos.logback:logback-core (0.9.2)

ch.qos.logback:logback-core MAVEN version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.9.2 - ch.qos.logback:logback-access 0.9.2 - ch.qos.logback:logback-classic...

ch.qos.logback:log4j-bridge (0.9.6), ch.qos.logback:logback-access (0.9.6) +4 more potentially affected by CVE-2024-12801 via ch.qos.logback:logback-core (0.9.6)

ch.qos.logback:logback-core MAVEN version 0.9.6 is affected by a known vulnerability. The following packages have a transitive dependency on ch.qos.logback:logback-core and may be impacted: - ch.qos.logback:log4j-bridge 0.9.6 - ch.qos.logback:logback-access 0.9.6 - ch.qos.logback:logback-classic...