Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, which may cause downstream log...

CVE-2026-34479

The CVE affects the Apache Log4j 1-to-Log4j 2 bridge: Log4j1XmlLayout used in Log4j Core 2 configurations or via the Log4j 1 compatibility layer with org.apache.log4j.xml.XMLLayout. The root cause is failure to properly escape characters forbidden by XML 1.0, producing malformed XML that conformi...