Apache LOG4CXX vulnerabilities

4 CVEs affecting Apache LOG4CXX, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-40023, published 2026-04-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-31038, published 2023-05-08. High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days. SQL injection in Log4cxx when using the ODBC appender to send log messages to a database. No fields sent to the database were properly escaped for SQL injection. This has been the case since at…
CVE-2025-54813, published 2025-08-22. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain…
CVE-2025-54812, published 2025-08-22. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped when writing out to the HTML file. If untrusted data is used to…
CVE-2026-40023, published 2026-04-10. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0…