Executive brief
Apache Log4cxx is a logging library for C++ applications. A vulnerability in its XML logging component allows attackers to insert special characters that break the structure of the resulting log files. This can cause security monitoring and log management systems to fail to process or index these logs, effectively allowing an attacker to hide their activities from audit trails.
Technical details
The XMLLayout component in Apache Log4cxx before version 1.7.0 fails to properly sanitize or escape characters forbidden by the XML 1.0 specification within log messages, Nested Diagnostic Context (NDC), and Mapped Diagnostic Context (MDC) property keys and values. When these illegal characters are included in a log event, the resulting XML document becomes malformed. Because conforming XML parsers are required to trigger a fatal error upon encountering such characters, downstream log consumers (such as SIEMs or indexing services) may drop the entire log record or stop processing the stream. An attacker who can influence data being logged can exploit this to suppress specific log entries, thereby impairing audit trails and security monitoring. This issue is addressed in version 1.7.0 by stripping or properly referencing illegal characters.
Affected products
- Apache Log4cxx versions before 1.7.0
Timeline
- 2026-03-19: patched: Fix merged into master branch
- 2026-04-10: disclosed: Initial vulnerability disclosure
- 2026-04-10: advisory: CVE-2026-40023 published
References
- https://github.com/apache/logging-log4cxx/pull/609
- https://lists.apache.org/thread/y15cv3zblg3dfwr5vy6ddbnl4zyrzr8b
- https://logging.apache.org/cyclonedx/vdr.xml
- https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html
- https://logging.apache.org/security.html
- http://www.openwall.com/lists/oss-security/2026/04/10/12