CVE-2026-34478
Apache Log4J 2.21.0 – 2.25.4
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-34478 is a medium-severity Improper Output Neutralization for Logs (CWE-117) vulnerability in Apache Log4J. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Indicator Removal (T1070); ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-34478 is a log injection vulnerability in Apache Log4j Core's Rfc5424Layout, affecting versions 2.21.0 through 2.25.3. It stems from undocumented renames of security-relevant configuration attributes, enabling CRLF sequence injection in log output. The issue impacts users of stream-based syslog services who configure Rfc5424Layout directly: the newLineEscape attribute rename disables newline escaping for TCP framing (RFC 6587), while the useTlsMessageFormat attribute rename causes TLS framing (RFC 5425) configurations to downgrade silently to unframed TCP without newline escaping. Users of SyslogAppender remain unaffected, as its attributes were unchanged.
Remote attackers require no privileges or user interaction to exploit this over the network with low complexity (CVSS 7.5: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), achieving high integrity impact via injected CRLF sequences. Exploitation occurs when untrusted input reaches the layout, allowing attackers to forge or split syslog messages, potentially misleading downstream log parsers, enabling command injection in log consumers, or disrupting log integrity (CWE-117: Improper Output Neutralization for Logs, CWE-684: Incorrect Provision of Specified Functionality).
Apache advisories recommend upgrading to Log4j Core 2.25.4, which restores proper attribute handling and escaping. Mitigation details appear in the security bulletin at https://logging.apache.org/security.html#CVE-2026-34478, the fixing pull request at https://github.com/apache/logging-log4j2/pull/4074, and the mailing list announcement at https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt. The Rfc5424Layout documentation at https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout notes the attribute changes.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21408
Vulnerability Data
Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly:…
more
* The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output. * The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping. Users of the SyslogAppender are not affected, as its configuration attributes were not modified. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing or incorrect output neutralization when log messages are constructed from untrusted input.
Requiring a documented development process and supporting tools reduces the chance that specified functionality will be implemented incorrectly.
Input validation reduces the chance that specially crafted data reaches log-message construction routines.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices and coding standards directly require output sanitization for logs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect log injection flaws but does not prevent them at the source.
Logging control directly requires proper log generation and handling, which mitigates improper output neutralization.
Monitoring activities rely on trustworthy logs but do not ensure log message integrity.
Secure SDLC includes coding standards that reduce log-related weaknesses but does not specifically address logging.
Explicit application security requirements and acceptance criteria help ensure the delivered software matches its intended specifications.
Secure coding practices mandate input validation and output encoding, directly preventing log injection.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
RHEL 9 (1 rule)
- V-258078 RHEL 9 must use a Linux Security Module configured to enforce limits on system services. prevents CWE-684