CVE-2025-54813

EUVD-2025-25622
Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.

When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.

This issue affects Apache Log4cxx: before 1.5.0.

Users are recommended to upgrade to version 1.5.0, which fixes the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
Affected Products (NVD)
VendorProductVersion
apachelog4cxx
𝑥
< 1.5.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
log4cxx
bookworm
1.0.0-1+deb12u1
fixed
bullseye
vulnerable
bullseye (security)
0.11.0-2+deb11u1
fixed
forky
1.5.0-1
fixed
sid
1.5.0-1
fixed
trixie
1.4.0-1+deb13u1
fixed
Common Weakness Enumeration
References
https://github.com/apache/logging-log4cxx/pull/512
https://logging.apache.org/security.html#CVE-2025-54813
http://www.openwall.com/lists/oss-security/2025/08/22/3
https://lists.debian.org/debian-lts-announce/2025/10/msg00002.html