Log4cxx (Apache) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 32 known versions, newest CVE from 2026-04-10. Vendor: Apache.

CVEs of Log4cxx

• CVE-2026-40023 - CVSS 6.3 (medium), 2026-04-10: Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize…
• CVE-2025-54813 - CVSS 7.5 (high), 2025-08-22: Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an…
• CVE-2025-54812 - CVSS 5.4 (medium), 2025-08-22: Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped when writing out to the…
• CVE-2023-31038 - CVSS 8.8 (high), 2023-05-08: SQL injection in Log4cxx when using the ODBC appender to send log messages to a database.  No fields sent to the database were properly escaped for SQL…