6.3
Medium
CVE-2025-54813 Improper Output Neutralization for Logs vulnerability in Apache Log4cxx
Description
Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Log4cxx 0.11 | 0.11.0 → < 1.5.0 | 1.5.0 |
References
- logging.apache.org logging.apache.org
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Apache Log4cxx
The 4 CVEs of Apache Log4cxx →
CVE-2026-40023
Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions…
6.3
Medium
CVE-2025-54812
Improper Output Neutralization for Logs vulnerability in Apache Log4cxx
2.1
Low
CVE-2023-31038
SQL injection in Log4cxx when using the ODBC appender to send log messages to a database. No fields sent to the…
Not rated