CVE-2025-54813mediumCWE-117

CVE-2025-54813: medium-severity vulnerability in Apache Log4cxx

Apache Log4cxx: Improper escaping with JSONLayout

Published · Updated

Follow this CVE+ Monitor Apache Log4cxx+ Monitor log4cxx

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 1.4%
Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Affected products
Apache Software Foundation · Apache Log4cxx
Related CVEs — Apache Log4cxx

In the same product, most dangerous first.

CVE-2023-31038HIGHApache Log4cxx: SQL injection when using ODBC appenderEPSS 1.6%CVE-2025-54812LOWApache Log4cxx: Improper HTML escaping in HTMLLayoutEPSS 1.2%CVE-2026-40023MEDIUMApache Log4cxx, Apache Log4cxx (Conan), Apache Log4cxx (Brew): Silent log event loss in XMLLayout due to unescaped XML 1.0 forbidden charactersEPSS 0.5%