Description

Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.

INFO

Published Date :

2026-04-10T15:45:52.895Z

Last Modified :

2026-04-10T17:29:20.009Z

Source :

apache
AFFECTED PRODUCTS

The following products are affected by CVE-2026-40023 vulnerability.

Vendors Products
Apache
  • Log4cxx
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-40023.

URL Resource
https://github.com/apache/logging-log4cxx/pull/609 cve-icon cve-icon
https://lists.apache.org/thread/y15cv3zblg3dfwr5vy6ddbnl4zyrzr8b cve-icon cve-icon
https://logging.apache.org/cyclonedx/vdr.xml cve-icon cve-icon
https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html cve-icon cve-icon
https://logging.apache.org/security.html#CVE-2026-40023 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability