← Vulnerability feed

Vulnerability record · CVE-2025-54813 · published 22 August 2025

CVE-2025-54813: Apache log4cxx vulnerability

Apache · Log4cxx

Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

6.3 CVSS 4.0 Medium EPSS 1.3% · top 30.8% CWE-117 · CWE-117
6.3CVSS 4.0 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/apache/logging-log4cxx/pull/512 Issue TrackingPatch
https://logging.apache.org/security.html#CVE-2025-54813 Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/08/22/3
https://lists.debian.org/debian-lts-announce/2025/10/msg00002.html

Track CVE-2025-54813 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-31038Apache log4cxx sql injection vulnerabilitySQL injection in Log4cxx when using the ODBC appender to send log messages to a database.  No fields sent to the database were properly escaped for S…EPSS 1.6%6.3CVE-2026-40023Apache log4cxx vulnerabilityApache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to saniti…EPSS 0.98%2.1CVE-2025-54812Apache log4cxx vulnerabilityImproper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using HTMLLayout, logger names are not properly escaped when writing ou…EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2025-54813), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.