PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34478 Apache Software Foundation CVE debrief

CVE-2026-34478 debrief based on the supplied source corpus. Apache Log4j Core's Rfc5424Layout, in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly: The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output. The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without

Vendor
Apache Software Foundation
Product
Apache Log4j Core
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-10
Original CVE updated
2026-10-26
Advisory published
2026-04-10
Advisory updated
2026-10-26

Who should care

Defenders and administrators using Apache Log4j Core's Rfc5424Layout in stream-based syslog services should assess exposure and upgrade to version 2.25.4. Users of stream-based syslog services who configure Rfc5424Layout directly are at risk of log injection attacks via CRLF sequences. Upgrade to Apache Log4j Core 2.25.4 is recommended to address this issue. Review and update configurations for Rfc5424Layout, and monitor for potential log injection attacks

Why it matters

Defenders should care about CVE-2026-34478 as it affects Apache Log4j Core's Rfc5424Layout, potentially allowing log injection attacks via CRLF sequences. Users of stream-based syslog services who configure Rfc5424Layout directly are at risk. Upgrade to Apache Log4j Core 2.25.4 is recommended to address this issue.

  • Potential log injection attacks via CRLF sequences
  • Downgrade to unframed TCP without newline escaping
  • Exposure to log injection in log output
  • Verification of configurations and upgrade to patched version

Technical summary

Apache Log4j Core's Rfc5424Layout is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes in versions 2.21.0 through 2.25.3. The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output. The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping.

Defensive priority

Upgrade to Apache Log4j Core 2.25.4 to address log injection vulnerability

Recommended defensive actions

  • Upgrade to Apache Log4j Core 2.25.4
  • Review and update configurations for Rfc5424Layout
  • Monitor for potential log injection attacks
  • Verify configurations and upgrade to patched version
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the log injection vulnerability in Apache Log4j Core's Rfc5424Layout, affecting versions 2.21.0 through 2.25.3. The vulnerability allows for log injection attacks via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Users of stream-based syslog services who configure Rfc5424Layout directly are at risk. The newLineEscape and useTlsMessageFormat attributes were silently renamed, leading to exposure to CRLF injection in log output and downgrade to un

Sources and references

Verified primary and authoritative sources

  • CVE-2026-34478 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-34478

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-34478 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-34478

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.