CVE-2025-54813

22.08.2025, 19:15

Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.

When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.

This issue affects Apache Log4cxx: before 1.5.0.

Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
apache	CNA	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 54%

Vendor	Product	Version
apache	log4cxx	𝑥 < 1.5.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

log4cxx

bullseye	vulnerable
trixie	no-dsa
bookworm	no-dsa
bullseye (security)	0.11.0-2+deb11u1 fixed
forky	1.4.0-1.1 fixed
sid	1.5.0-1 fixed

Common Weakness Enumeration

CWE-117 - Improper Output Neutralization for Logs
The software does not neutralize or incorrectly neutralizes output that is written to logs.

References

https://github.com/apache/logging-log4cxx/pull/512

https://logging.apache.org/security.html#CVE-2025-54813