Is CVE-2026-34477 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34477 being exploited in the wild.

How severe is CVE-2026-34477?

Medium severity, with a CVSS score of 5.9, published 10 April 2026.

Which products and versions are affected?

org.apache.logging.log4j:log4j-core (Maven) ECOSYSTEM:introduced=2.12.0,fixed=2.25.4.

Is there a fix for CVE-2026-34477?

Yes. org.apache.logging.log4j:log4j-core (Maven): upgrade to 2.25.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34477 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34477?

Check whether you run org.apache.logging.log4j:log4j-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34477: Apache Log4j Core improper certificate validation in network appenders

CVE-2026-34477 · Severity: medium · CVSS 5.9 · Published 2026-04-10

Apache Log4j is a widely used logging library for Java applications. A security flaw exists where certain encrypted connections (TLS) fail to verify the identity of the server they are connecting to, even when configured to do so. This could allow a sophisticated attacker on the same network to intercept or modify log data being sent to remote servers, potentially exposing sensitive system information or operational logs.

Technologies: org.apache.logging.log4j:log4j-core (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-34477 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34477 being exploited in the wild.
How severe is CVE-2026-34477?: Medium severity, with a CVSS score of 5.9, published 10 April 2026.
Which products and versions are affected?: org.apache.logging.log4j:log4j-core (Maven) ECOSYSTEM:introduced=2.12.0,fixed=2.25.4.
Is there a fix for CVE-2026-34477?: Yes. org.apache.logging.log4j:log4j-core (Maven): upgrade to 2.25.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34477 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34477?: Check whether you run org.apache.logging.log4j:log4j-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.logging.log4j:log4j-core (Maven): upgrade to 2.25.4 or later

# set org.apache.logging.log4j:log4j-core to 2.25.4 in your pom.xml or build.gradle

Technical details

Apache Log4j Core contains a vulnerability (CWE-297) where the 'verifyHostName' attribute within the <Ssl> configuration element is silently ignored. This flaw affects SMTP, Socket, and Syslog appenders when TLS is configured via nested <Ssl> elements. A network-based attacker can perform a man-in-the-middle (MitM) attack if they can present a certificate issued by a trusted Certificate Authority. This issue is an incomplete fix for a previous vulnerability and does not affect the HTTP appender. Users should upgrade to version 2.25.4 to ensure hostname verification is correctly enforced.

Affected products

Apache Log4j Core >= 2.12.0, < 2.25.4; >= 3.0.0-alpha1, <= 3.0.0-beta3

Identifiers

CVE-2026-34477
GHSA-6hg6-v5c8-fphq

Timeline

2026-04-10: advisory: Original advisory published by GitHub and NVD
2026-04-14: other: Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.