XML Parsing Issue in Apache Log4cxx Affects Log Integrity

CVE-2026-40023

What is CVE-2026-40023?

An issue in Apache Log4cxx's XMLLayout allows the inclusion of characters forbidden by the XML 1.0 specification, resulting in the generation of invalid XML output in log data. This flaw can enable an attacker to manipulate recorded logs, which may lead to the omission of critical log records essential for maintaining secure audit trails. Consequently, systems relying on these logs for monitoring malicious activities might either fail to index or entirely drop affected records. Users are encouraged to upgrade to Apache Log4cxx version 1.7.0, where this issue has been addressed.

References