CLSA-2026-1780447835 TuxCare security update for org.apache.logging.log4j (3 CVEs)

TuxCare rebuilt 32 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.22.1-tuxcare.1...

CLSA-2025-1751328204 TuxCare security update for log4j:log4j (6 CVEs)

TuxCare rebuilt log4j:log4j to address 6 CVEs. Fixed in 1.2.17.tuxcare.1...

Improper Encoding Or Escaping Of Output

Apache Log4j API is vulnerable to Improper Encoding or Escaping of Output. The vulnerability is due to improper encoding of non-finite floating-point values during MapMessage JSON serialization, which allows an attacker to inject NaN or Infinity values that produce malformed JSON and disrupt...

Security Bulletin: IBM Storage Protect Data Protection for Virtual Environments uses Apache Log4j version that is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes ( CVE-2026-34478)

Summary IBM Storage Protect Data Protection for Virtual Environments uses Apache Log4j version that is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. This issue has been fixed in this release by incorporating the Apache...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in log4j core (CVE-2026-34477, CVE-2026-34478)

Summary IBM Db2 Developer Extension is affected by vulnerability in log4j core CVE-2026-34477, CVE-2026-34478 Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verificatio...

ROOT-APP-MAVEN-CVE-2026-34477 CVE-2026-34477 in io.root.org.apache.logging.log4j:log4j-core - Patched by Root

Root has patched CVE-2026-34477 in the io.root.org.apache.logging.log4j:log4j-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-34479 CVE-2026-34479 in io.root.org.apache.logging.log4j:log4j-1.2-api - Patched by Root

Root has patched CVE-2026-34479 in the io.root.org.apache.logging.log4j:log4j-1.2-api package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-34481 CVE-2026-34481 in io.root.org.apache.logging.log4j:log4j-layout-template-json - Patched by Root

Root has patched CVE-2026-34481 in the io.root.org.apache.logging.log4j:log4j-layout-template-json package for Root:Maven. Multiple fixed versions available...

Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j

Summary Security Bulletin: IBM Engineering Systems Design Rhapsody TestConductor was affected by Vulnerability in log4j. Even though Rhapsody risk impact was low we have addressed these Vulnerability on our latest iFIx for all versions. Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The...

The vulnerability of the verifyHostName configuration parameter in the Apache Log4j Core library allows a attacker to perform a “man-in-the-middle” attack.

The vulnerability of the verifyHostName configuration parameter in the Apache Log4j Core logging library is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack remotely...

CVE-2026-49844

A flaw was found in Apache Log4j API. This vulnerability occurs due to improper encoding of non-finite floating-point values during JSON serialization of MapMessages, leading to invalid JSON output. An attacker who can supply a non-finite value can exploit this to cause the affected logging layou...

Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j API and jackson-databind

Summary IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j API and jackson-databind. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data...

Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server

Summary IBM Db2 is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM Db2 have been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affect...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling Secure Proxy and are addressed in the latest release and fixpack Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of th...

log4jpwn

log4jpwn log4j rce test environment. See: This repository c...

Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling External Authentication Server and are addressed in the latest release and ifix Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not...

Apache Log4j2 Remote Code Injection

Apache Log4j2 =2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when...

Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Shell CVE-2021-44228 Proof-of-Concept Lab An isolated...

OESA-2026-3153 log4j security update

Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fixes: Apache Log4j's JsonTemplateLayout in versions up to and including 2.25.3 produces invalid JSON output when log events contain non-finite floating-point values NaN, Infinity, or -Infinity,...

Oracle Essbase (July 2026 CPU)

The version of Oracle Essbase installed on the remote host is missing a security patch from the July 2026 Critical Patch Update CPU. It is, therefore, affected by: - Apache Log4j's JsonTemplateLayout, in versions up to and including 2.25.3, produces invalid JSON output when log events contain...