Is CVE-2026-34478 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34478 being exploited in the wild.

How severe is CVE-2026-34478?

High severity, with a CVSS score of 7.5, published 10 April 2026.

Which products and versions are affected?

org.apache.logging.log4j:log4j-core (Maven) ECOSYSTEM:introduced=2.21.0,fixed=2.25.4.

Is there a fix for CVE-2026-34478?

Yes. org.apache.logging.log4j:log4j-core (Maven): upgrade to 2.25.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34478 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34478?

Check whether you run org.apache.logging.log4j:log4j-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34478: Apache Log4j Core log injection in Rfc5424Layout

CVE-2026-34478 · Severity: high · CVSS 7.5 · Published 2026-04-10

Apache Log4j Core, a widely used logging library for Java applications, contains a flaw that can allow attackers to inject malicious entries into system logs. This occurs because certain security settings were accidentally disabled during a software update, potentially allowing attackers to hide their activities or spoof log data. Organizations using specific syslog configurations should update to ensure their audit logs remain accurate and secure.

Technologies: org.apache.logging.log4j:log4j-core (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-34478 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34478 being exploited in the wild.
How severe is CVE-2026-34478?: High severity, with a CVSS score of 7.5, published 10 April 2026.
Which products and versions are affected?: org.apache.logging.log4j:log4j-core (Maven) ECOSYSTEM:introduced=2.21.0,fixed=2.25.4.
Is there a fix for CVE-2026-34478?: Yes. org.apache.logging.log4j:log4j-core (Maven): upgrade to 2.25.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34478 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34478?: Check whether you run org.apache.logging.log4j:log4j-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.logging.log4j:log4j-core (Maven): upgrade to 2.25.4 or later

# set org.apache.logging.log4j:log4j-core to 2.25.4 in your pom.xml or build.gradle

Technical details

Apache Log4j Core's Rfc5424Layout component is vulnerable to log injection via CRLF sequences. The vulnerability stems from the undocumented renaming of two configuration attributes: 'newLineEscape' and 'useTlsMessageFormat'. When users configure Rfc5424Layout directly, the 'newLineEscape' rename causes newline escaping to fail for TCP framing (RFC 6587), while the 'useTlsMessageFormat' rename causes a silent downgrade from TLS framing (RFC 5425) to unframed TCP without escaping. Attackers can exploit this via the network to inject arbitrary log entries. Users of SyslogAppender are unaffected. A fix is available in version 2.25.4.

Affected products

Apache Log4j Core >= 2.21.0, < 2.25.4; >= 3.0.0-beta1, <= 3.0.0-beta3

Identifiers

CVE-2026-34478
GHSA-445c-vh5m-36rj

Timeline

2026-04-10: disclosed
2026-04-10: advisory
2026-04-10: patched: Fixed in version 2.25.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.